CVE-2026-23234

HIGH EPSS 2.1%
Published Mar 4, 20263mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Mar 4, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in f2fs_write_end_io(). It is caused by below race condition: loop device umount - worker_thread - loop_process_work - do_req_filebacked - lo_rw_aio - lo_rw_aio_complete - blk_mq_end_request - blk_update_request - f2fs_write_end_io - dec_page_count - folio_end_writeback - kill_f2fs_super - kill_block_super - f2fs_put_super : free(sbi) : get_pages(, F2FS_WB_CP_DATA) accessed sbi which is freed In kill_f2fs_super(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folio_end_writeback(). Let's relocate ckpt thread wakeup flow before folio_end_writeback() to resolve this issue.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
2.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥3.13  –  <5.10.251
linuxlinux_kernel*≥5.11  –  <5.15.201
linuxlinux_kernel*≥5.16  –  <6.1.164
linuxlinux_kernel*≥6.2  –  <6.6.127
linuxlinux_kernel*≥6.7  –  <6.12.74
linuxlinux_kernel*≥6.13  –  <6.18.13
linuxlinux_kernel*≥6.19  –  <6.19.3

References 8

  • git.kernel.org https://git.kernel.org/stable/c/0fb58aff0dafd6837cc91f4154f3ed6e020358fa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2f67ff1e15a8a4d0e4ffc6564ab20d03d7398fe9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/505e1c0530db6152cab3feef8e3e4da3d3e358c9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/995030be4ce6338c6ff814583c14166446a64008
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a42f99be8a16b32a0bb91bb6dda212a6ad61be5d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/acc2c97fc0005846e5cf11b5ba3189fef130c9b3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ce2739e482bce8d2c014d76c4531c877f382aa54
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf4a9e1bc8129eb63fda5f8bdcd8d87f0bd76f42
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/0fb58aff0dafd6837cc91f4154f3ed6e020358fa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2f67ff1e15a8a4d0e4ffc6564ab20d03d7398fe9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/505e1c0530db6152cab3feef8e3e4da3d3e358c9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/995030be4ce6338c6ff814583c14166446a64008
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a42f99be8a16b32a0bb91bb6dda212a6ad61be5d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/acc2c97fc0005846e5cf11b5ba3189fef130c9b3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ce2739e482bce8d2c014d76c4531c877f382aa54
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf4a9e1bc8129eb63fda5f8bdcd8d87f0bd76f42
    Patch