CVE-2026-23267: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23267 is a race condition vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) subsystem, specifically caused by concurrent atomic commit and checkpoint write operations leading to an IS_CHECKPOINTED flag inconsistency. The flaw affects Linux kernel versions from 4.7 through multiple stable branches, with fixed versions at 6.1.164, 6.6.127, 6.12.74, 6.18.13, and 6.19.3. It was published on March 18, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Microsoft MSRC).

The root cause is a race condition (CWE-362) in the F2FS filesystem's node write and checkpoint synchronization logic. When Thread A executes f2fs_ioc_commit_atomic_write and schedules before acquiring folio_lock(last_folio), Thread B's f2fs_write_checkpoint can concurrently execute f2fs_flush_nat_entries, setting the IS_CHECKPOINTED bit on the NAT entry. Thread A then writes the node folio with fsync/dentry marks set, but the checkpoint has already marked the entry as checkpointed — creating an inconsistent state that causes f2fs_recover_inode_page to return -EINVAL during subsequent mount/recovery operations. The attack vector is local, requires low privileges (write access to an F2FS filesystem), and no user interaction (Red Hat Advisory, Kernel Announcement).

Successful exploitation results in a denial of service affecting the F2FS filesystem: the filesystem becomes unmountable or returns -EINVAL errors during recovery, rendering stored data inaccessible until the issue is resolved. There is no confidentiality or integrity impact — only availability is affected. The scope is limited to the local system and the specific F2FS filesystem instance, with no evidence of lateral movement potential (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting very low probability of exploitation in the near term. Triggering the race condition requires local access and the ability to perform concurrent atomic write and checkpoint operations on an F2FS filesystem (Red Hat Advisory).

Apply the appropriate patched Linux kernel version for your branch: 6.1.164 or later (for 4.7–6.1 branch), 6.6.127 or later (for 6.2–6.6 branch), 6.12.74 or later (for 6.7–6.12 branch), 6.18.13 or later (for 6.13–6.18 branch), or 6.19.3 or later (for 6.19+ branch). Azure Linux users should update to azl3_kernel_6.6.126.1-1 or later. Patches are available via the stable kernel tree on git.kernel.org and through vendor update channels including Microsoft and Red Hat (Red Hat Advisory, Microsoft MSRC, Kernel Patch).