CVE-2026-89834: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-92fw-gww6-96g8
Share
Published
Advisory Summary

CVE-2026-89834 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89834 at a Glance

CVE Identifier CVE-2026-89834
GHSA Identifier GHSA-92fw-gww6-96g8
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89834

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89834, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.

References

NVD — CVE-2026-89834 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89834
git.kernel.org/stable/c/3b85edf339... WEB
https://git.kernel.org/stable/c/3b85edf3391f3e1f624f409a7d2d239885f567b7
git.kernel.org/stable/c/8ec06f50dd... WEB
https://git.kernel.org/stable/c/8ec06f50ddd8d201bd7e55b896ae28ed9d4cb7d1
git.kernel.org/stable/c/b8ae1228c1... WEB
https://git.kernel.org/stable/c/b8ae1228c153622afa71a179c9d4dc268117e0f0
git.kernel.org/stable/c/b9776094aa... WEB
https://git.kernel.org/stable/c/b9776094aa7118e8e5dfdcd791ffc8330c5ca408

Frequently Asked Questions

What is CVE-2026-89834?
CVE-2026-89834 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89834?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89834?
CVE-2026-89834 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89834?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-92fw-gww6-96g8",
  "modified" : "2026-09-16T12:30:38Z",
  "published" : "2026-09-16T12:30:38Z",
  "aliases" : [ "CVE-2026-89834" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to migrate all curseg types during free_segment_range\n\nIn free_segment_range(), the curseg evacuation loop only iterates up to\nNR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg\ntypes such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC.\n\nEven though these in-memory curseg types are not saved in the on-disk\ncheckpoint header, they still occupy active physical segments at runtime.\nIf an active in-memory curseg happens to be allocated within the segment\nrange being truncated during filesystem shrink, failing to evacuate it\nwill cause subsequent writes to the curseg attempting out-of-bounds I/O\non the truncated storage range.\n\nFix this by expanding the curseg evacuation loop upper bound to\nNR_CURSEG_TYPE to ensure all active curseg types are safely migrated\nout of the target range.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89834"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3b85edf3391f3e1f624f409a7d2d239885f567b7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8ec06f50ddd8d201bd7e55b896ae28ed9d4cb7d1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b8ae1228c153622afa71a179c9d4dc268117e0f0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b9776094aa7118e8e5dfdcd791ffc8330c5ca408"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:16:50Z"
  }
}