Linux Kernel up to 6.18.12/6.19.2 fs/f2fs/data.c f2fs_write_end_io privilege escalation

Summaryinfo

A vulnerability described as problematic has been identified in Linux Kernel up to 6.18.12/6.19.2. This impacts the function f2fs_write_end_io of the file fs/f2fs/data.c. Executing a manipulation can lead to an unknown weakness. This vulnerability is registered as CVE-2026-23265. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.18.12/6.19.2 and classified as problematic. This vulnerability affects the function f2fs_write_end_io of the file fs/f2fs/data.c. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer in {read,write}_end_io -----------[ cut here ]------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: <IRQ> blk_update_request+0x5eb/0xe70 block/blk-mq.c:987 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149 blk_complete_reqs block/blk-mq.c:1224 [inline] blk_done_softirq+0x107/0x160 block/blk-mq.c:1229 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 </IRQ> In f2fs_write_end_io(), it detects there is inconsistency in between node page index (nid) and footer.nid of node page. If footer of node page is corrupted in fuzzed image, then we load corrupted node page w/ async method, e.g. f2fs_ra_node_pages() or f2fs_ra_node_page(), in where we won't do sanity check on node footer, once node page becomes dirty, we will encounter this bug after node page writeback.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-23265 since 01/13/2026. The exploitation appears to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/01/2026).

Upgrading to version 6.18.13, 6.19.3 or 7.0-rc1 eliminates this vulnerability. Applying the patch 855c54f1803e3ebc613677b4f389c7f92656a1fc/c386753db52b3a80afa6612bfdcb925aa5ca260f/50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-12904) and CERT Bund (WID-SEC-2026-0790). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.19.0
• 6.19.1
• 6.19.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion