CVE-2026-23265: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23265 is a Linux kernel vulnerability in the f2fs (Flash-Friendly File System) subsystem that allows a local user to trigger a kernel panic (denial of service) by mounting a crafted filesystem image with a corrupted node footer. The flaw affects Linux kernel versions from 3.8 up to (but not including) 6.18.13, and 6.19 up to (but not including) 6.19.3. It was disclosed on March 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is insufficient input validation (CWE-20) in the f2fs kernel module's I/O completion handlers read_end_io and write_end_io. When a node page is loaded asynchronously via f2fs_ra_node_pages() or f2fs_ra_node_page(), no sanity check is performed on the node footer to verify that the node page index (nid) matches footer.nid. If the footer is corrupted — for example, in a fuzzed or maliciously crafted f2fs image — the corrupted page is accepted into the page cache. Once the page becomes dirty and is flushed during writeback, f2fs_write_end_io() detects the nid/footer.nid inconsistency and triggers a kernel BUG at fs/f2fs/data.c:358, causing a system crash (Red Hat Bugzilla, Feedly).

Successful exploitation causes a kernel panic, resulting in a complete denial of service (system crash) on the affected host. The impact is limited to availability — there is no confidentiality or integrity impact. An attacker with local access and the ability to mount a crafted f2fs filesystem image can reliably crash the system, potentially disrupting all services running on it (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access and the ability to mount a crafted f2fs image, limiting its attack surface. The EPSS score is approximately 0.017% (0.000170), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel panic messages containing kernel BUG at fs/f2fs/data.c:358 in /var/log/kern.log or dmesg output.
• Logs: Call trace entries referencing f2fs_write_end_io, blk_update_request, blk_mq_end_request, and blk_done_softirq in kernel logs.
• File System: Presence of unusual or externally supplied f2fs filesystem images being mounted by non-root users.
• Process: Unexpected system reboots or kernel oops events correlated with f2fs mount or writeback activity.

Apply the upstream kernel patches available in Linux kernel versions 6.18.13 and 6.19.3 (or later), which add sanity checks on node footer data during asynchronous node page loading. Reference patch commits are 50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4, 855c54f1803e3ebc613677b4f389c7f92656a1fc, and c386753db52b3a80afa6612bfdcb925aa5ca260f. As a workaround prior to patching, restrict the ability of unprivileged users to mount f2fs filesystems (e.g., via nosuid/nodev mount policies or by disabling user-namespace-based mounts) and validate filesystem images before mounting (Red Hat Bugzilla, Feedly).