UBUNTU-CVE-2026-89836: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages() race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in[1] which related to broken xarray slot status. By investigating big folio operations within f2fs, we find below races and fix it by get the nrpages before drop the refcount and foliolock. f2fsgetreaddatafolio() calls f2fsfolioput() before folionrpages() when invalidating a large folio from the page cache. That unlocks the folio and drops the caller reference, leaving a window where a concurrent truncate or folio split can shrink the compound folio or free it before the invalidate range is computed. An undersized range then leaves split sub-folios in mapping->ipages, which can later interact badly with truncate and reclaim (stale xarray entries and bad page state when folio->mapping no longer matches the mapping being truncated). [1] PID: 2594 TASK: ffffff8169b81580 CPU: 7 COMMAND: "Thread-3" #0 [ffffffc08ef2b8a0] xasload at ffffffe52d1f42a4 #1 [ffffffc08ef2b900] findgetentries at ffffffe52c185798 #2 [ffffffc08ef2bb60] truncateinodepagesrange at ffffffe52c19e83c #3 [ffffffc08ef2bbc0] truncateinodepagesfinal at ffffffe52c19ec2c #4 [ffffffc08ef2bc20] f2fsevictinode at ffffffe52c4c8400 #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4 #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4 #7 [ffffffc08ef2bd30] dentryunlinkinode at ffffffe52c2d7204 #8 [ffffffc08ef2bd50] dentrykill at ffffffe52c2d3dcc #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c #10 [ffffffc08ef2bda0] fput at ffffffe52c2b0a7c #11 [ffffffc08ef2bde0] fput at ffffffe52c2b1034 #12 [ffffffc08ef2bdf0] taskworkrun at ffffffe52beea200 #13 [ffffffc08ef2be20] exittousermodeloop at ffffffe52bfbc17c #14 [ffffffc08ef2be80] el0svc at ffffffe52d1f8e54 #15 [ffffffc08ef2beb0] el0t64synchandler at ffffffe52d1f8d10