CVE-2026-23235 f2fs: fix out-of-bounds access in sysfs attribute read/write

What is CVE-2026-23235?

CVE-2026-23235 is a high-severity memory corruption vulnerability in Linux kernel, published on 4 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix out-of-bounds access in sysfs attribute read/write

Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes.

For example: vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1

carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update.

atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX.

The root causes are: 1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes.

2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes.

This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.

Weakness: CWE-125

Which versions are affected by CVE-2026-23235?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-23235?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-23235 being exploited?

There is no known exploitation of CVE-2026-23235 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-23235, DEBIAN-CVE-2026-23235, GHSA-39w6-g297-pmf5, ROOT-OS-DEBIAN-11-CVE-2026-23235, ROOT-OS-DEBIAN-12-CVE-2026-23235, ROOT-OS-DEBIAN-13-CVE-2026-23235 and 3 more.