CVE-2026-89834

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to migrate all curseg types during free_segment_range

In free_segment_range(), the curseg evacuation loop only iterates up to

NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg

types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC.

Even though these in-memory curseg types are not saved in the on-disk

checkpoint header, they still occupy active physical segments at runtime.

If an active in-memory curseg happens to be allocated within the segment

range being truncated during filesystem shrink, failing to evacuate it

will cause subsequent writes to the curseg attempting out-of-bounds I/O

on the truncated storage range.

Fix this by expanding the curseg evacuation loop upper bound to

NR_CURSEG_TYPE to ensure all active curseg types are safely migrated

out of the target range.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References