CVE-2026-23265— f2fs: fix to do sanity check on node footer in {read,write}_end_io
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23265
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
f2fs: fix to do sanity check on node footer in {read,write}_end_io
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer in {read,write}_end_io -----------[ cut here ]------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: <IRQ> blk_update_request+0x5eb/0xe70 block/blk-mq.c:987 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149 blk_complete_reqs block/blk-mq.c:1224 [inline] blk_done_softirq+0x107/0x160 block/blk-mq.c:1229 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 </IRQ> In f2fs_write_end_io(), it detects there is inconsistency in between node page index (nid) and footer.nid of node page. If footer of node page is corrupted in fuzzed image, then we load corrupted node page w/ async method, e.g. f2fs_ra_node_pages() or f2fs_ra_node_page(), in where we won't do sanity check on node footer, once node page becomes dirty, we will encounter this bug after node page writeback.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于节点页脚完整性检查不足，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-23265
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23265
请登录查看更多情报信息。
Same Patch Batch · Linux · 2026-03-18 · 35 CVEs total
| CVE-2026-23246 | 8.8 HIGH | wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration |
| CVE-2026-23253 | 7.8 HIGH | media: dvb-core: fix wrong reinitialization of ringbuffer on reopen |
| CVE-2026-23268 | 7.8 HIGH | apparmor: fix unprivileged local user can do privileged policy management |
| CVE-2026-23270 | 7.8 HIGH | net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks |
| CVE-2026-23248 | 7.8 HIGH | perf/core: Fix refcount bug and potential UAF in perf_mmap |
| CVE-2026-23243 | 7.8 HIGH | RDMA/umad: Reject negative data_len in ib_umad_write |
| CVE-2026-23245 | 7.8 HIGH | net/sched: act_gate: snapshot parameters with RCU on replace |
| CVE-2026-23242 | 7.5 HIGH | RDMA/siw: Fix potential NULL pointer dereference in header processing |
| CVE-2026-23269 | 7.1 HIGH | apparmor: validate DFA start states are in bounds in unpack_pdb |
| CVE-2026-23244 | nvme: fix memory allocation in nvme_pr_read_keys() | |
| CVE-2025-71267 | fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST | |
| CVE-2026-23247 | tcp: secure_seq: add back ports to TS offset | |
| CVE-2025-71266 | fs: ntfs3: check return value of indx_find to avoid infinite loop | |
| CVE-2026-23249 | xfs: check for deleted cursors when revalidating two btrees | |
| CVE-2026-23250 | xfs: check return value of xchk_scrub_create_subord | |
| CVE-2026-23251 | xfs: only call xf{array,blob}_destroy if we have a valid pointer | |
| CVE-2026-23252 | xfs: get rid of the xchk_xfile_*_descr calls | |
| CVE-2025-71265 | fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata | |
| CVE-2025-71268 | btrfs: fix reservation leak in some error paths when inserting inline extent | |
| CVE-2025-71269 | btrfs: do not free data reservation in fallback from inline due to -ENOSPC |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2026-23265
No comments yet