cbcvebase.
CVE-2026-23234
published 2026-03-04

CVE-2026-23234: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in…

PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.1th percentile
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in f2fs_write_end_io(). It is caused by below race condition: loop device umount - worker_thread - loop_process_work - do_req_filebacked - lo_rw_aio - lo_rw_aio_complete - blk_mq_end_request - blk_update_request - f2fs_write_end_io - dec_page_count - folio_end_writeback - kill_f2fs_super - kill_block_super - f2fs_put_super : free(sbi) : get_pages(, F2FS_WB_CP_DATA) accessed sbi which is freed In kill_f2fs_super(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folio_end_writeback(). Let's relocate ckpt thread wakeup flow before folio_end_writeback() to resolve this issue.

Affected

53 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.164-1 (bookworm)linux 6.1.164-1 (bookworm)
debianlinux-6.1< linux 6.1.164-1 (bookworm)linux 6.1.164-1 (bookworm)
linuxlinux
linuxlinux>= 4c8ff7095bef64fc47e996a938f7d57f9e077da3 < 57bc678f36ac03281e877c6b84877b43f964143f57bc678f36ac03281e877c6b84877b43f964143f
linuxlinux>= 4c8ff7095bef64fc47e996a938f7d57f9e077da3 < ef57cd3329b40c739b9a2e1a8a21ecc4171c6280ef57cd3329b40c739b9a2e1a8a21ecc4171c6280
linuxlinux>= 4c8ff7095bef64fc47e996a938f7d57f9e077da3 < f5154cf3ce1c8193f0c1891d3769f62740cfe6fef5154cf3ce1c8193f0c1891d3769f62740cfe6fe
linuxlinux>= 4c8ff7095bef64fc47e996a938f7d57f9e077da3 < c76cf339b87975ae5b2c06d2d774d5667d25a12ac76cf339b87975ae5b2c06d2d774d5667d25a12a
linuxlinux>= 4c8ff7095bef64fc47e996a938f7d57f9e077da3 < 2c97dcb6147c8f7f25c629b93be1e69617de5d4a2c97dcb6147c8f7f25c629b93be1e69617de5d4a
linuxlinux>= 4c8ff7095bef64fc47e996a938f7d57f9e077da3 < 39d4ee19c1e7d753dd655aebee632271b171f43a39d4ee19c1e7d753dd655aebee632271b171f43a
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.251-15.10.251-1
linuxlinux_kernel>= 0 < 6.1.164-16.1.164-1
linuxlinux_kernel>= 0 < 6.12.74-26.12.74-2
linuxlinux_kernel>= 0 < 6.18.13-16.18.13-1
linuxlinux_kernel>= 3.13 < 5.10.2515.10.251
linuxlinux_kernel>= 5.11 < 5.15.2015.15.201
linuxlinux_kernel>= 5.16 < 6.1.1646.1.164
linuxlinux_kernel>= 5.6 < 6.6.1366.6.136
linuxlinux_kernel>= 6.13 < 6.18.256.18.25
linuxlinux_kernel>= 6.13 < 6.18.136.18.13
linuxlinux_kernel>= 6.19 < 7.0.27.0.2
linuxlinux_kernel>= 6.19 < 6.19.36.19.3
linuxlinux_kernel>= 6.2 < 6.6.1276.6.127
linuxlinux_kernel>= 6.7 < 6.12.846.12.84
linuxlinux_kernel>= 6.7 < 6.12.746.12.74

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.