CVE-2026-23235 f2fs: fix out-of-bounds access in sysfs attribute read/write

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Addressed in f2fs Vulnerabilities On March 4, 2026, two critical vulnerabilities were published affecting the f2fs filesystem. CVE-2026-23235 addresses an out-of-bounds access issue, while CVE-2026-23234 fixes a use-after-free vulnerability in the f2fs_write_end_io() function. These vulnerabilities could potentially lead to exploitation if not addressed promptly. 2 sources 63