In the Linux kernel, the following vulnerability has been resolved:

f2fs: only redirty pinned folios in redirty_blocks

redirty_blocks() pins folios with read_cache_folio() and then walks the
same range again with filemap_lock_folio() to redirty them and drop the
references it took.

Commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()") changed
the second pass to a do/while loop. If read_cache_folio() fails before
anything is pinned, page_idx does not advance but the cleanup loop still
runs once.

If readahead has already populated the failed folio in page cache, that
extra iteration finds it and folio_put_refs(folio, 2) drops one
reference too many. Later drop_caches or reclaim can then report
"BUG: Bad page state".

Only redirty the range that was pinned successfully.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
5951fee46befbf6176c86482432f4f76e522f16c affected < 445e4a1e6025ecd5312e9a95c1b234192c976ca1
5951fee46befbf6176c86482432f4f76e522f16c affected < 89c65ec3c18903de763cf567c96ab3ef60e5f3b0
5951fee46befbf6176c86482432f4f76e522f16c affected < 85171332742e741ccd6f401c69b6e0d698119e72
Linux Linux affected
Version Status Constraints
6.16 affected —
0 unaffected < 6.16
6.18.51 unaffected ≤ 6.18.*
7.2.5 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/445e4a1e6025ecd5312e9a95c1b234192c976ca1 cve-icon
https://git.kernel.org/stable/c/85171332742e741ccd6f401c69b6e0d698119e72 cve-icon
https://git.kernel.org/stable/c/89c65ec3c18903de763cf567c96ab3ef60e5f3b0 cve-icon
History

Wed, 16 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirty_blocks redirty_blocks() pins folios with read_cache_folio() and then walks the same range again with filemap_lock_folio() to redirty them and drop the references it took. Commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()") changed the second pass to a do/while loop. If read_cache_folio() fails before anything is pinned, page_idx does not advance but the cleanup loop still runs once. If readahead has already populated the failed folio in page cache, that extra iteration finds it and folio_put_refs(folio, 2) drops one reference too many. Later drop_caches or reclaim can then report "BUG: Bad page state". Only redirty the range that was pinned successfully.
Title f2fs: only redirty pinned folios in redirty_blocks
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-16T10:31:15.578Z

Reserved: 2026-09-11T19:38:34.770Z

Link: CVE-2026-89841

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.