CVE-2026-89840

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the f2fs file system where the F2FS IOC MOVE RANGE operation fails to validate the destination end before updating the i size (the size of the inode). This occurs because the clone blkaddrs() function skips NULL ADDR entries and returns success, allowing the caller to extend the destination inode using an unchecked pos out + len calculation when a source hole is present.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.