https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:12:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89840 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>f2fs: validate MOVE_RANGE destination size</p> <p>F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.</p> <p>Reject destination overflow and use inode_newsize_ok() before extending the destination inode.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>f2fs: validate MOVE_RANGE destination size</p> <p>F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.</p> <p>Reject destination overflow and use inode_newsize_ok() before extending the destination inode.</p> https://vulnerability.circl.lu/vuln/cve-2026-89840