Incorrect authorization in Linux kernel - CVE-2026-89839
Published: September 17, 2026
Vulnerability identifier: #VU150451
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89839
CWE-ID: CWE-863
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to modify the system.advise extended attribute without proper authorization.
The vulnerability exists due to improper authorization in f2fs_xattr_advise_set() when setting the system.advise extended attribute through an idmapped f2fs mount. A local user can attempt to set the system.advise extended attribute to modify the system.advise extended attribute without proper authorization.
Affected software
Linux kernel
How to mitigate CVE-2026-89839
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/3b681229e9f8fb1dd29bc65983bf3c87779e4ca3
- https://git.kernel.org/stable/c/4c0c610b480cfbc57528aa1acbd6be12ed2a6fb1
- https://git.kernel.org/stable/c/a54ffce4637acb0db8e695188a6c7f99f14c3576
- https://git.kernel.org/stable/c/ab31e3b774f5d06b4489cef6c297b48c47c9dcbd
- https://git.kernel.org/stable/c/c3e2692c7a58e0bdb84bd658d827e89dcecea3ad