Linux CVE-2026-23265

This vulnerability presents a moderate-to-high real-world risk despite the absence of published CVSS and EPSS scores. The attack vector is local with low complexity, requiring an attacker to provide a malicious f2fs filesystem image (e.g., via USB, network mount, or container image). The technical impact is denial of service via kernel panic, which is automatable and reproducible. The vulnerability is not listed in KEV (Known Exploited Vulnerabilities), but the straightforward nature of crafting a fuzzed filesystem image means proof-of-concept code would be trivial to develop. The kernel BUG backtrace indicates the panic occurs during IRQ context (blk_done_softirq), making it difficult to mitigate at runtime. Systems relying on f2fs (embedded systems, Android devices, flash storage systems) face higher risk than traditional server deployments. The availability of three stable kernel commits in the references suggests the fix is production-ready and priority should be HIGH for f2fs-using environments.

An attacker creates a malicious f2fs filesystem image with a corrupted node page footer (nid value mismatched to the page index) and distributes it as a seemingly benign container image or USB filesystem. When a target system mounts this image, the kernel's f2fs driver asynchronously loads node pages via f2fs_ra_node_pages() without validating the footer, and the corrupted page is cached. When the system later writes back the corrupted node page during normal I/O operations (e.g., filesystem sync or periodic writeback), f2fs_write_end_io() detects the nid mismatch and triggers a kernel BUG, causing an immediate kernel panic and system reboot. This denial-of-service attack requires no privilege escalation and affects systems in production environments relying on user-supplied or untrusted filesystem images.