CVE-2026-23234: f2fs: fix to avoid UAF in f2fs_write_end_io()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid UAF in f2fswriteendio()
As syzbot reported an use-after-free issue in f2fswriteendio().
It is caused by below race condition:
loop device umount - workerthread - loopprocesswork - doreqfilebacked - lorwaio - lorwaiocomplete - blkmqendrequest - blkupdaterequest - f2fswriteendio - decpagecount - folioendwriteback - killf2fssuper - killblocksuper - f2fsputsuper : free(sbi) : getpages(, F2FSWBCPDATA) accessed sbi which is freed
In killf2fssuper(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folioendwriteback().
Let's relocate ckpt thread wakeup flow before folioendwriteback() to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23234?
CVE-2026-23234 has been classified with a medium severity rating due to the potential for exploitation in specific race conditions.
How do I fix CVE-2026-23234?
To fix CVE-2026-23234, update your Linux kernel to the latest stable version where the issue has been resolved.
What systems are affected by CVE-2026-23234?
CVE-2026-23234 affects the Linux kernel versions that include the f2fs file system.
What type of vulnerability is CVE-2026-23234?
CVE-2026-23234 is identified as a use-after-free vulnerability that can lead to unexpected behavior and potential security risks.
Who reported CVE-2026-23234?
CVE-2026-23234 was reported by the syzbot, a testing tool used for identifying vulnerabilities in the kernel.