UBUNTU-CVE-2026-89837: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel() gets a dentry folio with f2fsfinddatafolio() before calling findinblock(). If findinblock() returns an error, the function stores the error in resfolio and breaks out of the loop without dropping the dentry folio. This leaks the folio reference on the findinblock() error path. Drop the dentry folio before returning the error to the caller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In find_in_level(), drop the dentry folio before returning an error when find_in_block() fails.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running an affected Ubuntu kernel package are exposed only when they use the F2FS filesystem. The listed package families are linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-riscv, and linux-gkeop.
What must occur for the leak to be triggered?
The issue requires an error path in F2FS directory lookup: find_in_level() must obtain a dentry folio and find_in_block() must then return an error. The provided information does not identify the specific conditions that cause find_in_block() to fail.
What is the impact of successful triggering?
The error path leaks a reference to a dentry folio because it is not dropped before the error is returned. The supplied severity vector identifies availability impact as high, with no stated impact to confidentiality or integrity.