PT-2026-26127 · F2Fs+1 · F2Fs+1

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23267

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue in the F2FS filesystem related to an inconsistency in the IS CHECKPOINTED flag. This occurs due to concurrent atomic commit and checkpoint writes. Specifically, under certain conditions involving simultaneous operations from two threads (Thread A and Thread B), the IS CHECKPOINTED flag within a nat entry structure might not be correctly set. This can lead to a scenario where a dentry mark is set and a folio is written again unnecessarily after a checkpoint write has completed. The issue manifests during SPO (Shoot-Parity Optimization) tests and can result in a non-NULL blk addr in node info after a reboot. The problem is isolated to atomic write scenarios and does not affect regular file fsync operations where the folio is dirty. The root cause is related to the order of operations and the acquisition of sbi->node write during atomic file fsync. The vulnerability involves the following: - API Endpoints: f2fs ioc commit atomic write - Vulnerable Parameters or Variables: last folio, nat entry, node info, sbi (superblock information), ino (inode number) - Function Names: f2fs recover inode page, f2fs do sync file, f2fs fsync node pages, f2fs write checkpoint, f2fs flush nat entries, f2fs need dentry mark, write node folio, f2fs do write node page

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-662

Related Identifiers

BDU:2026-04158

CVE-2026-23267

Affected Products

F2Fs

Linux Kernel

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23267.json · Exploit
• https://git.kernel.org/stable/c/bd66b4c487d5091d2a65d6089e0de36f0c26a4c7 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-23267 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23267 · Vendor Advisory
• https://git.kernel.org/stable/c/7633a7387eb4d0259d6bea945e1d3469cd135bbc · Patch
• https://bdu.fstec.ru/vul/2026-04158 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23267 · Vendor Advisory
• https://git.kernel.org/stable/c/75e19da068adf0dc5dd269dd157392434b9117d4 · Patch
• https://ubuntu.com/security/CVE-2026-23267 · Vendor Advisory
• https://git.kernel.org/stable/c/962c167b0f262b9962207fbeaa531721d55ea00e · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23267 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23267 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23267 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23267 · Vendor Advisory