CVE-2026-89836

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix folio_nr_pages() race after put in large folio invalidate

Our v6.18 based Android system is continuely suffering livelock and bad

page stat as shown in[1] which related to broken xarray slot status. By

investigating big folio operations within f2fs, we find below races and

fix it by get the nr_pages before drop the refcount and folio_lock.

f2fs_get_read_data_folio() calls f2fs_folio_put() before

folio_nr_pages() when invalidating a large folio from the page cache.

That unlocks the folio and drops the caller reference, leaving a window

where a concurrent truncate or folio split can shrink the compound folio

or free it before the invalidate range is computed. An undersized range

then leaves split sub-folios in mapping->i_pages, which can later

interact badly with truncate and reclaim (stale xarray entries and bad

page state when folio->mapping no longer matches the mapping being

truncated).

[1]

PID: 2594

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References