Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23235— f2fs: fix out-of-bounds access in sysfs attribute read/write

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于sysfs属性读写存在越界访问和整数处理不当问题。

AI Predicted 7.8 Difficulty: Hard EPSS 0.16% · P4

Possible ATT&CK Techniques 1 AI

T1552 · Unsecured Credentials

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux b59d0bae6ca30c496f298881616258f9cde0d9c6< e85a99db9ab85dfc30d93b0ca0e9156f3127f55a affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< 438a405fbad6882df0e34b3e1a16839a71f04240 affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< 6a6c07a9b49e43f0df42d7118fc76aa555c73d98 affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< eebd72cff518ac87e660aefb8a41224bd88c32ce affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< 4ef30b9f1641c9e877792df6b049f1cf507d002d affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< d4a594dd952df123cbdcdee9b9640d9d55e4a954 affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< 3a905e183c047577b154f08a78ac3039e9454703 affected
b59d0bae6ca30c496f298881616258f9cde0d9c6< 98ea0039dbfdd00e5cc1b9a8afa40434476c0955 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23235

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
f2fs: fix out-of-bounds access in sysfs attribute read/write
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix out-of-bounds access in sysfs attribute read/write Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes. For example: vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1 carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update. atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX. The root causes are: 1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes. 2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes. This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于sysfs属性读写存在越界访问和整数处理不当问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b59d0bae6ca30c496f298881616258f9cde0d9c6 ~ e85a99db9ab85dfc30d93b0ca0e9156f3127f55a -
Linux Linux 3.12 -

II. Public POCs for CVE-2026-23235

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23235

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23235 (8)

Same Patch Batch · Linux · 2026-03-04 · 9 CVEs total

CVE-2026-23231 7.8 HIGH netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
CVE-2026-23236 7.3 HIGH fbdev: smscufx: properly copy ioctl memory to kernelspace
CVE-2026-23232 Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
CVE-2025-71238 scsi: qla2xxx: Fix bsg_done() causing double free
CVE-2026-23233 f2fs: fix to avoid mapping wrong physical block for swapfile
CVE-2026-23234 f2fs: fix to avoid UAF in f2fs_write_end_io()
CVE-2026-23238 romfs: check sb_set_blocksize() return value
CVE-2026-23237 platform/x86: classmate-laptop: Add missing NULL pointer checks

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23235

No comments yet

Leave a comment