Not yet scoredPublished Sep 16, 2026

CVE-2026-89837f2fs: fix dentry folio leak in find_in_level

Updated under an hour ago (Oct 27, 2026, 5:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in find_in_level find_in_level() gets a dentry folio with f2fs_find_data_folio() before calling find_in_block(). If find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the dentry folio. This leaks the folio reference on the find_in_block() error path. Drop the dentry folio before returning the error to the caller.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7ad08a58bf67594057362e45cbddd3e27e53e557 before b6c0e77d950bf80ab357e2b4b9667f4389ed417c; from 7ad08a58bf67594057362e45cbddd3e27e53e557 before af9cc316d31371824de8d409260a2ab9759dd51c; from 7ad08a58bf67594057362e45cbddd3e27e53e557 before aefb4b0f465b6f95fe02b52d1822a3fb4a9ae922; from 7ad08a58bf67594057362e45cbddd3e27e53e557 before 93a3e6a4c9e726a13a935963e8dc43d181db1527; from 7ad08a58bf67594057362e45cbddd3e27e53e557 before cca7d3e30bf30333314e31bc70b9a739f1342167	CNA record

References

References

https://git.kernel.org/stable/c/b6c0e77d950bf80ab357e2b4b9667f4389ed417c
https://git.kernel.org/stable/c/af9cc316d31371824de8d409260a2ab9759dd51c
https://git.kernel.org/stable/c/aefb4b0f465b6f95fe02b52d1822a3fb4a9ae922
https://git.kernel.org/stable/c/93a3e6a4c9e726a13a935963e8dc43d181db1527
https://git.kernel.org/stable/c/cca7d3e30bf30333314e31bc70b9a739f1342167

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.