CVE-2026-89838

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the F2FS (Flash-Friendly File System) where recovery filenames are stored as a length plus a fixed-size i name buffer. Because this buffer is not NUL-terminated, the recover inode() and recover dentry() functions may read past the i name buffer into subsequent raw inode fields when printing with %s, particularly for filenames that are 255 bytes long.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.