CyberSecBulletin
CVE-2026-23235NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-23235 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e85a99db9ab85dfc30d93b0ca0e9156f3127f55a, 438a405fbad6882df0e34b3e1a16839a71f04240, 6a6c07a9b49e43f0df42d7118fc76aa555c73d98 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to e85a99db9ab85dfc30d93b0ca0e9156f3127f55a or 438a405fbad6882df0e34b3e1a16839a71f04240 or 6a6c07a9b49e43f0df42d7118fc76aa555c73d98 or eebd72cff518ac87e660aefb8a41224bd88c32ce, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.251 or 5.15.201 or 6.1.164 or 6.6.127, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, e85a99db9ab85dfc30d93b0ca0e9156f3127f55a; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, 438a405fbad6882df0e34b3e1a16839a71f04240; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, 6a6c07a9b49e43f0df42d7118fc76aa555c73d98; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, eebd72cff518ac87e660aefb8a41224bd88c32ce; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, 4ef30b9f1641c9e877792df6b049f1cf507d002d; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, d4a594dd952df123cbdcdee9b9640d9d55e4a954; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, 3a905e183c047577b154f08a78ac3039e9454703; b59d0bae6ca30c496f298881616258f9cde0d9c6 up to, but not including, 98ea0039dbfdd00e5cc1b9a8afa40434476c0955; and 1 more rangese85a99db9ab85dfc30d93b0ca0e9156f3127f55a, 438a405fbad6882df0e34b3e1a16839a71f04240, 6a6c07a9b49e43f0df42d7118fc76aa555c73d98, eebd72cff518ac87e660aefb8a41224bd88c32ce, 4ef30b9f1641c9e877792df6b049f1cf507d002d, d4a594dd952df123cbdcdee9b9640d9d55e4a954
LinuxLinux Kernel3.12 up to, but not including, 5.10.251; 5.11 up to, but not including, 5.15.201; 5.16 up to, but not including, 6.1.164; 6.2 up to, but not including, 6.6.127; 6.7 up to, but not including, 6.12.74; 6.13 up to, but not including, 6.18.13; 6.19 up to, but not including, 6.19.35.10.251, 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.18.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix out-of-bounds access in sysfs attribute read/write Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes. For example: vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1 carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update. atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX. The root causes are: 1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes. 2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes. This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.