CVE-2026-23235: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23235 is an out-of-bounds memory access vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) filesystem, specifically in sysfs attribute read and write operations. The flaw affects Linux kernel versions from 3.12 through multiple stable branches, with fixed versions including 5.10.251, 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.18.13, and 6.19.3. It was published on March 4, 2026, with patches released on March 17, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read) and stems from two related flaws in the f2fs sysfs interface. First, __sbi_store() treats all attribute values as unsigned int, causing out-of-bounds writes when the underlying struct field is smaller (e.g., an 8-bit carve_out field can be set to values exceeding 255) and preventing correct updates for 64-bit fields. Second, f2fs_sbi_show() similarly assumes all values are unsigned int, leading to out-of-bounds reads and incorrect display of 64-bit integers. The fix introduces a size field in struct f2fs_attr to record the actual byte width of each attribute's associated integer, enabling correct bounds-aware read and write operations (Feedly, Kernel Patch).

A local user with low privileges can exploit this vulnerability to read out-of-bounds kernel memory, potentially disclosing sensitive kernel data, and to corrupt adjacent kernel data structures through out-of-bounds writes via sysfs attribute operations on f2fs filesystems. The confidentiality and availability impacts are both rated High, as kernel memory disclosure and data structure corruption can lead to system instability or crashes. There is no direct integrity impact assessed, and the scope is limited to the local system without privilege escalation to remote vectors (Feedly).

Update the Linux kernel to a patched version as the primary remediation. Fixed versions by branch are: 5.10.251+, 5.15.201+, 6.1.164+, 6.6.127+, 6.12.74+, 6.18.13+, and 6.19.3+. Debian has issued security advisories (DSA-6163-1 and DLA-4499-1) covering these fixes. As a temporary workaround, restrict sysfs write access to f2fs attributes to trusted/root users only by tightening filesystem permissions or using kernel lockdown features until patching is complete (Feedly, Debian LTS).

Debian issued security advisories (DSA-6163-1 and DLA-4499-1) addressing this vulnerability in their stable and LTS kernel packages. The Yocto Project security mailing list also flagged the issue for embedded Linux users. Coverage was limited to routine patch-tracking outlets and vendor advisory channels, with no notable independent researcher commentary or significant social media discussion observed (Debian LTS, Feedly).