CVE-2026-23235
Out-of-Bounds Memory Access in Linux f2fs sysfs Attributes
Publication date: 2026-03-04
Last updated on: 2026-03-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.16 (inc) to 6.1.164 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.201 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.127 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.74 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.13 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.3 (exc) |
| linux | linux_kernel | From 3.12 (inc) to 5.10.251 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's f2fs filesystem sysfs interface, where certain sysfs attributes allow out-of-bounds memory access and incorrect handling of integer values that are not 4 bytes in size.
Specifically, some attributes like 'carve_out' and 'atgc_age_threshold' can be set to values that exceed the size limits of their underlying integer types, causing memory corruption or truncation.
The root cause is that the sysfs interface functions (__sbi_store() and f2fs_sbi_show()) treat all integer values as unsigned int (4 bytes), which leads to incorrect reads and writes for integers smaller or larger than 4 bytes.
The fix involves introducing a size field to record the actual size of each integer attribute, allowing correct memory access and preventing out-of-bounds operations.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access when reading or writing certain f2fs sysfs attributes, which may cause memory corruption.
Memory corruption can potentially lead to system instability, crashes, or unexpected behavior in the kernel.
If exploited, it might allow an attacker with access to the sysfs interface to manipulate kernel memory improperly, possibly leading to privilege escalation or denial of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to read and write specific f2fs sysfs attributes that are known to be affected by out-of-bounds access and incorrect integer handling.
For example, you can use the following commands to test the behavior of the vulnerable sysfs attributes:
- echo 65537 > /sys/fs/f2fs/vde/carve_out
- cat /sys/fs/f2fs/vde/carve_out
- echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold
- cat /sys/fs/f2fs/vde/atgc_age_threshold
If the values written exceed the expected integer size limits but are still accepted or incorrectly handled (e.g., values larger than 255 for carve_out or values larger than UINT_MAX for atgc_age_threshold), this indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that introduces proper size handling for f2fs sysfs attributes to prevent out-of-bounds memory access.
Until the patch is applied, avoid writing values to the affected sysfs attributes that exceed their intended integer size limits, such as not writing values larger than 255 to carve_out or larger than UINT_MAX to atgc_age_threshold.
Monitoring and restricting access to these sysfs attributes can also help reduce the risk of exploitation.