CVE-2026-23235 in Linux
Summary
by MITRE • 03/04/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix out-of-bounds access in sysfs attribute read/write
Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes.
For example: vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1
carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit
integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update.
atgc_age_threshold maps to {struct atgc_management}->age_threshold,
which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX.
The root causes are: 1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes.
2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes.
This patch introduces {struct f2fs_attr}->size to record the actual size
of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/24/2026
The vulnerability described in CVE-2026-23235 represents a critical out-of-bounds memory access issue within the f2fs (Flash-Friendly File System) implementation of the Linux kernel. This flaw manifests in the sysfs attribute handling mechanisms that govern how system administrators and processes interact with f2fs filesystem parameters through the virtual filesystem interface. The vulnerability specifically targets the way integer values are processed when read from or written to sysfs attributes, creating potential paths for memory corruption and system instability. The issue affects the f2fs subsystem's ability to properly validate and handle integer values of varying sizes, particularly when these values exceed the standard 32-bit unsigned integer boundaries.
The technical root cause stems from fundamental assumptions made in the sysfs attribute handling code within the f2fs kernel module. The __sbi_store() function incorrectly treats all default values as unsigned 32-bit integers regardless of their actual data type, which creates a mismatch between the expected data size and the actual storage requirements of the underlying structures. This design flaw leads to two distinct but related issues: first, when attempting to write values larger than 4 bytes, the system cannot properly update the target integer fields, and second, when dealing with smaller integers such as 8-bit values, the code performs out-of-bounds writes that can corrupt adjacent memory locations. The f2fs_sbi_show() function compounds this problem by assuming all values are 32-bit unsigned integers during read operations, resulting in incorrect memory access patterns and data truncation. This type of vulnerability aligns with CWE-129, which addresses improper validation of array indices, and CWE-787, which covers out-of-bounds write conditions.
The operational impact of this vulnerability extends beyond simple data corruption, potentially enabling attackers to manipulate kernel memory structures through carefully crafted sysfs writes. When an attacker writes a value of 65537 to the carve_out attribute, which maps to an 8-bit integer field, the system fails to properly truncate or validate the input, allowing values to overflow into adjacent memory regions. Similarly, writing 4294967297 to atgc_age_threshold, a 64-bit integer field, results in truncation to 1 due to the 32-bit assumption in the sysfs interface. These behaviors create potential attack vectors for privilege escalation and system compromise, as demonstrated by the ATT&CK framework's T1068, which covers local privilege escalation through kernel vulnerabilities. The vulnerability affects systems running Linux kernels with f2fs filesystem support, particularly those where f2fs is actively used for storage management and where sysfs interfaces are accessible to unprivileged users or processes.
The mitigation strategy for this vulnerability involves implementing proper data size tracking within the f2fs sysfs attribute handling code. The proposed solution introduces a size field in the struct f2fs_attr structure that explicitly records the actual data size associated with each sysfs attribute. This enhancement enables the sysfs read and write operations to correctly handle integer values according to their real data type characteristics, preventing both out-of-bounds writes and incorrect memory access patterns. The fix ensures that 8-bit integers cannot be overflowed with values exceeding 255, while 64-bit integers properly accommodate values up to their maximum representable range. This approach aligns with secure coding practices that emphasize proper data type validation and bounds checking, addressing the fundamental design flaw that allowed incorrect memory access patterns. The solution maintains backward compatibility while strengthening the kernel's memory protection mechanisms and preventing the type of memory corruption that could lead to privilege escalation or system instability.