CVE-2026-23235: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23235 Overview

CVE-2026-23235 is an out-of-bounds memory access vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) subsystem. The vulnerability exists in the sysfs attribute read and write operations, where incorrect handling of integer values whose size differs from 4 bytes leads to memory corruption and data truncation issues.

The vulnerability affects how f2fs sysfs attributes are processed through the __sbi_store() and f2fs_sbi_show() functions. When writing values to sysfs attributes that map to integers smaller than 4 bytes (such as 8-bit integers), values exceeding the target type's range can be written, causing out-of-bounds memory writes. Conversely, for integers larger than 4 bytes (such as 64-bit integers), the sysfs interface cannot correctly set values larger than UINT_MAX, leading to truncation.

Critical Impact
Local attackers with access to f2fs sysfs attributes can trigger out-of-bounds memory writes and reads, potentially leading to memory corruption, kernel crashes, or privilege escalation on affected Linux systems.

Affected Products

Linux kernel with f2fs filesystem support
Systems using f2fs filesystem with sysfs interface exposed
Linux distributions with affected kernel versions

Discovery Timeline

March 04, 2026 - CVE-2026-23235 published to NVD
March 04, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23235

Vulnerability Analysis

The f2fs filesystem exposes various configuration parameters through the sysfs interface under /sys/fs/f2fs/<device>/. These attributes allow administrators to tune f2fs behavior at runtime. However, the implementation incorrectly assumes all attribute values are unsigned int (4 bytes), regardless of the actual underlying data type.

When a value like 65537 is written to the carve_out attribute (which maps to an 8-bit integer {struct f2fs_sb_info}->carve_out), the sysfs interface accepts the value without bounds checking. This results in an out-of-range write where only the lower bits are stored, but the memory access itself can corrupt adjacent memory locations.

Similarly, when accessing 64-bit attributes like atgc_age_threshold (which maps to {struct atgc_management}->age_threshold), values larger than UINT_MAX (4294967295) cannot be correctly set. Writing 4294967297 results in only the value 1 being stored due to integer truncation.

Root Cause

The root cause lies in two problematic functions within the f2fs sysfs implementation:

__sbi_store() function: This function treats all default values as unsigned int, preventing correct updates for integers larger than 4 bytes and causing out-of-bounds writes for integers smaller than 4 bytes.
f2fs_sbi_show() function: Similarly assumes all values are unsigned int, leading to out-of-bounds reads and incorrect representation of values larger than 4 bytes.

The fix introduces a size field in {struct f2fs_attr} to record the actual size of each integer associated with sysfs attributes, enabling correct memory access based on the true data type.

Attack Vector

An attacker with local access to an f2fs-mounted filesystem can exploit this vulnerability by writing crafted values to sysfs attributes:

The attacker identifies f2fs sysfs attributes at /sys/fs/f2fs/<device>/
By writing out-of-range values to attributes mapping to smaller integers, memory corruption can occur
The corrupted memory may affect kernel structures, potentially leading to privilege escalation or denial of service

The exploitation requires local access with sufficient permissions to write to f2fs sysfs attributes, typically requiring root or specific capability privileges.

Detection Methods for CVE-2026-23235

Indicators of Compromise

Unexpected kernel crashes or oops messages referencing f2fs or sysfs functions
Anomalous values in f2fs sysfs attributes that don't match expected ranges
Unusual write operations to /sys/fs/f2fs/*/ paths with large integer values

Detection Strategies

Monitor sysfs write operations to f2fs attributes using auditd or similar frameworks
Implement kernel function tracing on __sbi_store() and f2fs_sbi_show() to detect abnormal access patterns
Deploy kernel integrity monitoring to detect memory corruption symptoms

Monitoring Recommendations

Enable audit logging for all writes to /sys/fs/f2fs/ directory structure
Monitor system logs for f2fs-related kernel warnings or errors
Track processes accessing f2fs sysfs attributes with unexpected privilege levels

How to Mitigate CVE-2026-23235

Immediate Actions Required

Update to a patched Linux kernel version that includes the f2fs sysfs fix
Restrict access to f2fs sysfs attributes using appropriate file permissions
Consider remounting f2fs filesystems with restricted options until patching is complete

Patch Information

The Linux kernel developers have released patches across multiple stable kernel branches. The fix introduces {struct f2fs_attr}->size to properly track integer sizes for each sysfs attribute, ensuring correct memory access during read and write operations.

Patches are available through the following kernel git commits:

Workarounds

Restrict access to f2fs sysfs attributes by modifying permissions on /sys/fs/f2fs/ directories
Use SELinux or AppArmor policies to limit which processes can access f2fs sysfs interfaces
Consider using alternative filesystems in high-security environments until patches are applied

bash

# Restrict f2fs sysfs access permissions
chmod 700 /sys/fs/f2fs/*/
# Monitor f2fs sysfs access attempts
auditctl -w /sys/fs/f2fs/ -p wa -k f2fs_sysfs_access