CVE-2026-23234 f2fs: fix to avoid UAF in f2fs_write_end_io()
A use-after-free vulnerability in the Linux kernel's f2fs filesystem allows local attackers to potentially execute code or escalate privileges via a race condition during unmount.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23234?
CVE-2026-23234 is a high-severity use after free vulnerability in Linux kernel, published on 4 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid UAF in f2fs_write_end_io()
As syzbot reported an use-after-free issue in f2fs_write_end_io().
It is caused by below race condition:
loop device umount - worker_thread - loop_process_work - do_req_filebacked - lo_rw_aio - lo_rw_aio_complete - blk_mq_end_request - blk_update_request - f2fs_write_end_io - dec_page_count - folio_end_writeback - kill_f2fs_super - kill_block_super - f2fs_put_super : free(sbi) : get_pages(, F2FS_WB_CP_DATA) accessed sbi which is freed
In kill_f2fs_super(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folio_end_writeback().
Let's relocate ckpt thread wakeup flow before folio_end_writeback() to resolve this issue.
Weakness: CWE-416
Which versions are affected by CVE-2026-23234?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23234?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-23234 being exploited?
There is no known exploitation of CVE-2026-23234 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23234, DEBIAN-CVE-2026-23234, GHSA-chrj-6658-798c, ROOT-OS-DEBIAN-11-CVE-2026-23234, ROOT-OS-DEBIAN-12-CVE-2026-23234, ROOT-OS-DEBIAN-13-CVE-2026-23234 and 3 more.