Skip to main content

Checkpoint CVE-2026-23267

| EUVDEUVD-2026-12908 MEDIUM
2026-03-18 Linux
Information Disclosure Linux Red Hat Suse Checkpoint
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Impact

While CVSS and EPSS scores are not provided for this CVE, the technical risk assessment indicates moderate to high real-world severity. The vulnerability requires specific conditions: concurrent atomic write operations and checkpoint execution, followed by sudden power-off during the critical window. The technical impact involves information disclosure through incorrect inode state recovery (node_info->blk_addr not set to NULL_ADDR as expected), which could expose data block addresses or lead to file system inconsistency. The attack complexity is moderate to high as it requires precise timing to trigger the race condition. However, the vulnerability is not remotely exploitable and requires local file system access. The patch availability across six stable kernel branches (evidenced by six git commit references) indicates this is a recognized issue in active development. The limitation to atomic write scenarios reduces the attack surface compared to regular fsync operations, but atomic writes are used by database and transaction systems, making this relevant for production environments.
Exploit ScenarioDerived

A local attacker with file system access could exploit this during a database transaction or atomic file operation (such as database commit). The attacker would need to trigger an atomic write operation on a file while the kernel concurrently executes a checkpoint operation, then cause a sudden power-off during the critical race window (for example, by cutting power or triggering a kernel panic). Upon system recovery and remounting, the file system could be in an inconsistent state with incorrect inode metadata, potentially exposing data block addresses or allowing the attacker to manipulate file recovery behavior. No public proof-of-concept is referenced, but the vulnerability is deterministic under SPO testing conditions, suggesting reproducibility in controlled environments.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

This vulnerability is a race condition in the Linux kernel's F2FS file system that causes flag inconsistency between concurrent atomic commit and checkpoint write operations. The issue affects all Linux kernel versions with F2FS support (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*), allowing information disclosure through incorrect inode state recovery after sudden power-off (SPO) scenarios. An attacker with local file system access during atomic write operations could trigger the race condition, leading to potential data inconsistency and information leakage when the system recovers.

RemediationAI

Update the Linux kernel to a version that includes the fix commits from the stable branches (verify specific version numbers via kernel.org and your distribution's advisory pages). The fix involves acquiring the sbi->node_write lock during atomic file fsync operations in __write_node_folio to ensure proper synchronization of the IS_CHECKPOINTED flag with actual checkpoint completion. For systems unable to immediately patch, implement workarounds by disabling atomic write operations if possible (though this may impact application performance), ensuring adequate battery backup or UPS protection to minimize sudden power-off scenarios during checkpoint windows, and scheduling checkpoint operations during low system load periods. Systems using F2FS on SSDs or other devices should prioritize patching as atomic writes are commonly used by database systems and transaction-based applications. Refer to the stable kernel commits at https://git.kernel.org/stable for patch details and deployment guidance.

Affected VersionsENISA

Linux 608514deba38c8611ad330d6a3c8e2b9a1f68e4b <bd66b4c487d5091d2a65d6089e0de36f0c26a4c7
Linux 608514deba38c8611ad330d6a3c8e2b9a1f68e4b <962c167b0f262b9962207fbeaa531721d55ea00e
Linux patch: 6.6.127
Linux 608514deba38c8611ad330d6a3c8e2b9a1f68e4b <7633a7387eb4d0259d6bea945e1d3469cd135bbc
Linux patch: 6.1.164
Linux patch: 6.18.13
Linux 608514deba38c8611ad330d6a3c8e2b9a1f68e4b <32bc3c9fe18881d50dd51fd5f26d19fe1190dc0d
Linux 608514deba38c8611ad330d6a3c8e2b9a1f68e4b <ed81bc5885460905f9160e7b463e5708fd056324
Linux 4.7
Linux patch: 0
Linux patch: 7.0-rc1
Linux patch: 6.19.3
Linux patch: 6.12.74
Linux 608514deba38c8611ad330d6a3c8e2b9a1f68e4b <75e19da068adf0dc5dd269dd157392434b9117d4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the F2FS (Flash-Friendly File System) implementation within the Linux kernel. F2FS is a log-structured file system optimized for NAND flash memory. The root cause is a synchronization issue in the IS_CHECKPOINTED flag management within the nat_entry structure during concurrent execution of f2fs_ioc_commit_atomic_write and f2fs_write_checkpoint functions. The race condition occurs when Thread A performs atomic file fsync operations while Thread B executes checkpoint writes, causing the IS_CHECKPOINTED flag to not be properly set before the folio (page) write is submitted. This violates the expected invariant that the flag state accurately reflects checkpoint completion status. The affected product is the Linux kernel with F2FS support (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*), and the root cause relates to improper synchronization primitives (similar to CWE-367: Time-of-check Time-of-use Race Condition) in the node write locking mechanism.

Know when Checkpoint gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 29, 2026 - 18:52 NVD
5.5 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 18, 2026 - 17:46 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes

During SPO tests, when mounting F2FS, an -EINVAL error was returned from f2fs_recover_inode_page. The issue occurred under the following scenario

Thread A Thread B f2fs_ioc_commit_atomic_write

  • f2fs_do_sync_file // atomic = true
  • f2fs_fsync_node_pages

: last_folio = inode folio : schedule before folio_lock(last_folio) f2fs_write_checkpoint

  • block_operations// writeback last_folio
  • schedule before f2fs_flush_nat_entries

: set_fsync_mark(last_folio, 1) : set_dentry_mark(last_folio, 1) : folio_mark_dirty(last_folio)

  • __write_node_folio(last_folio)

: f2fs_down_read(&sbi->node_write)//block

  • f2fs_flush_nat_entries

: {struct nat_entry}->flag |= BIT(IS_CHECKPOINTED)

  • unblock_operations

: f2fs_up_write(&sbi->node_write) f2fs_write_checkpoint//return : f2fs_do_write_node_page() f2fs_ioc_commit_atomic_write//return SPO

Thread A calls f2fs_need_dentry_mark(sbi, ino), and the last_folio has already been written once. However, the {struct nat_entry}->flag did not have the IS_CHECKPOINTED set, causing set_dentry_mark(last_folio, 1) and write last_folio again after Thread B finishes f2fs_write_checkpoint.

After SPO and reboot, it was detected that {struct node_info}->blk_addr was not NULL_ADDR because Thread B successfully write the checkpoint.

This issue only occurs in atomic write scenarios. For regular file fsync operations, the folio must be dirty. If block_operations->f2fs_sync_node_pages successfully submit the folio write, this path will not be executed. Otherwise, the f2fs_write_checkpoint will need to wait for the folio write submission to complete, as sbi->nr_pages[F2FS_DIRTY_NODES] > 0. Therefore, the situation where f2fs_need_dentry_mark checks that the {struct nat_entry}->flag /wo the IS_CHECKPOINTED flag, but the folio write has already been submitted, will not occur.

Therefore, for atomic file fsync, sbi->node_write should be acquired through __write_node_folio to ensure that the IS_CHECKPOINTED flag correctly indicates that the checkpoint write has been completed.

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel File System Integrity

View all 2
CVE-2026-23265 MEDIUM
5.5

More in Checkpoint

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
CVE-2026-93616 CRITICAL POC
9.8 Sep 22

Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
CVE-2021-3449 MEDIUM
5.9 Mar 25

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
CVE-2026-91843 CRITICAL POC
9.8 Sep 16

Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm fixed 6.1.164-1 -
bookworm (security) fixed 6.1.164-1 -
trixie fixed 6.12.74-1 -
trixie (security) fixed 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.18.13-1 -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23267 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/?id.351566 REF https://git.kernel.org/stable/c/32bc3c9fe18881d50dd51fd5f26d19fe1190dc0d REF https://git.kernel.org/stable/c/75e19da068adf0dc5dd269dd157392434b9117d4 REF https://git.kernel.org/stable/c/7633a7387eb4d0259d6bea945e1d3469cd135bbc REF https://git.kernel.org/stable/c/962c167b0f262b9962207fbeaa531721d55ea00e REF https://git.kernel.org/stable/c/bd66b4c487d5091d2a65d6089e0de36f0c26a4c7 REF https://git.kernel.org/stable/c/ed81bc5885460905f9160e7b463e5708fd056324

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy