---
id: CVE-2026-89836
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  f2fs: fix folio_nr_pages() race after put in large folio invalidate

  Our v6.18 based Android system is continuely suffering livelock and bad
  page stat as shown in[1] wh…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  f2fs: fix folio_nr_pages() race after put in large folio invalidate

  Our v6.18 based Android system is continuely suffering livelock and bad
  page stat as shown in[1] wh…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 05e65c14ea59a401cec4284e9d612f9d5dc1b3f8 <
    cc34df18da92f68f9b384c3ae95ad64be46cb5ee
  - >-
    Linux >= 05e65c14ea59a401cec4284e9d612f9d5dc1b3f8 <
    0dab71381f1b4d12dc2056f8bd5aaa9d93ce9082
  - Linux 7.0
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:12.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89836'
references:
  - url: 'https://git.kernel.org/stable/c/0dab71381f1b4d12dc2056f8bd5aaa9d93ce9082'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc34df18da92f68f9b384c3ae95ad64be46cb5ee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.998Z'
epss: 0.00165
epssPercentile: 0.05034
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix folio_nr_pages() race after put in large folio invalidate

Our v6.18 based Android system is continuely suffering livelock and bad
page stat as shown in[1] which related to broken xarray slot status. By
investigating big folio operations within f2fs, we find below races and
fix it by get the nr_pages before drop the refcount and folio_lock.

f2fs_get_read_data_folio() calls f2fs_folio_put() before
folio_nr_pages() when invalidating a large folio from the page cache.
That unlocks the folio and drops the caller reference, leaving a window
where a concurrent truncate or folio split can shrink the compound folio
or free it before the invalidate range is computed. An undersized range
then leaves split sub-folios in mapping->i_pages, which can later
interact badly with truncate and reclaim (stale xarray entries and bad
page state when folio->mapping no longer matches the mapping being
truncated).

[1]
PID: 2594     TASK: ffffff8169b81580  CPU: 7    COMMAND: "Thread-3"
 #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4
 #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798
 #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c
 #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c
 #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400
 #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4
 #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4
 #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204
 #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc
 #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c
 #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c
 #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034
 #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200
 #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c
 #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54
 #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.