CVE-2026-23235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix out-of-bounds access in sysfs attribute read/write Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes. For example: vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1 carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update. atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX. The root causes are: 1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes. 2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes. This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.

• CWE-125

• https://git.kernel.org/stable/c/3a905e183c047577b154f08a78ac3039e9454703Patch
• https://git.kernel.org/stable/c/438a405fbad6882df0e34b3e1a16839a71f04240Patch
• https://git.kernel.org/stable/c/4ef30b9f1641c9e877792df6b049f1cf507d002dPatch
• https://git.kernel.org/stable/c/6a6c07a9b49e43f0df42d7118fc76aa555c73d98Patch
• https://git.kernel.org/stable/c/98ea0039dbfdd00e5cc1b9a8afa40434476c0955Patch
• https://git.kernel.org/stable/c/d4a594dd952df123cbdcdee9b9640d9d55e4a954Patch
• https://git.kernel.org/stable/c/e85a99db9ab85dfc30d93b0ca0e9156f3127f55aPatch
• https://git.kernel.org/stable/c/eebd72cff518ac87e660aefb8a41224bd88c32cePatch

Published

Mar 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2323Inappropriate implementation in Downloads in Google Chrome p…4.3
• CVE-2026-23230In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23231In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-23232In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23233In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-23234In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-23236In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23237In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23238In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23239In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-2324The LatePoint – Calendar Booking Plugin for Appointments and…6.1
• CVE-2026-23240In the Linux kernel, the following vulnerability has been re…9.8