SB20260917129 - Incorrect authorization in Linux kernel f2fs
Published: September 17, 2026
Security Bulletin ID
SB20260917129
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Incorrect authorization (CVE-ID: CVE-2026-89839)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify the system.advise extended attribute without proper authorization.
The vulnerability exists due to improper authorization in f2fs_xattr_advise_set() when setting the system.advise extended attribute through an idmapped f2fs mount. A local user can attempt to set the system.advise extended attribute to modify the system.advise extended attribute without proper authorization.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/3b681229e9f8fb1dd29bc65983bf3c87779e4ca3
- https://git.kernel.org/stable/c/4c0c610b480cfbc57528aa1acbd6be12ed2a6fb1
- https://git.kernel.org/stable/c/a54ffce4637acb0db8e695188a6c7f99f14c3576
- https://git.kernel.org/stable/c/ab31e3b774f5d06b4489cef6c297b48c47c9dcbd
- https://git.kernel.org/stable/c/c3e2692c7a58e0bdb84bd658d827e89dcecea3ad