CVE-2026-89839

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to the ->set() handler. f2fs supports idmapped mounts, so on such a mount this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EPERM and an unrelated caller wrongly allowed. Pass the handler's idmap instead.

Is your site exposed to CVE-2026-89839?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0020

Probability of exploitation

0.09%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/3b681229e9f8fb1dd29bc65983bf3c87779e4ca3 https://git.kernel.org/stable/c/4c0c610b480cfbc57528aa1acbd6be12ed2a6fb1 https://git.kernel.org/stable/c/a54ffce4637acb0db8e695188a6c7f99f14c3576 https://git.kernel.org/stable/c/ab31e3b774f5d06b4489cef6c297b48c47c9dcbd https://git.kernel.org/stable/c/c3e2692c7a58e0bdb84bd658d827e89dcecea3ad

Frequently Asked Questions

What is CVE-2026-89839? +

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to the ->set() handler. f2fs supports idmapped mounts, so on such a mount this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EPERM and an unrelated caller wrongly allowed. Pass the handler's idmap instead.

How do I check if I'm vulnerable to CVE-2026-89839? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.