CVE-2026-89839
Published Sep 16, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to the ->set() handler. f2fs supports idmapped mounts, so on such a mount this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EPERM and an unrelated caller wrongly allowed. Pass the handler's idmap instead.
Is your site exposed to CVE-2026-89839?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/3b681229e9f8fb1dd29bc65983bf3c87779e4ca3
https://git.kernel.org/stable/c/4c0c610b480cfbc57528aa1acbd6be12ed2a6fb1
https://git.kernel.org/stable/c/a54ffce4637acb0db8e695188a6c7f99f14c3576
https://git.kernel.org/stable/c/ab31e3b774f5d06b4489cef6c297b48c47c9dcbd
https://git.kernel.org/stable/c/c3e2692c7a58e0bdb84bd658d827e89dcecea3ad
Frequently Asked Questions
What is CVE-2026-89839? +
In the Linux kernel, the following vulnerability has been resolved:
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap
before allowing the "system.advise" xattr to be set, instead of the idmap
that the VFS passes to the ->set() handler.
f2fs supports idmapped mounts, so on such a mount this checks the caller's
fsuid against the unmapped on-disk owner rather than the mapped owner: the
actual owner can be wrongly denied with -EPERM and an unrelated caller
wrongly allowed. Pass the handler's idmap instead.
How do I check if I'm vulnerable to CVE-2026-89839? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.