Vulnerability-Lookup

CERTFR-2026-AVI-0291

Vulnerability from certfr_avis - Published: 2026-03-13 - Updated: 2026-03-13

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian trixie versions antérieures à 6.12.74-2
	Debian	Debian	Debian bookworm versions antérieures à 6.1.164-1

References

Title

Publication Time

CVE-2026-23235 (GCVE-0-2026-23235)

Vulnerability from cvelistv5 – Published: 2026-03-04 14:36 – Updated: 2026-05-11 22:02

Title

f2fs: fix out-of-bounds access in sysfs attribute read/write

Summary

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix out-of-bounds access in sysfs attribute read/write Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes. For example: vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1 carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update. atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX. The root causes are: 1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes. 2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes. This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7018 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/e85a99db9ab85dfc3…
https://git.kernel.org/stable/c/438a405fbad6882df…
https://git.kernel.org/stable/c/6a6c07a9b49e43f0d…
https://git.kernel.org/stable/c/eebd72cff518ac87e…
https://git.kernel.org/stable/c/4ef30b9f1641c9e87…
https://git.kernel.org/stable/c/d4a594dd952df123c…
https://git.kernel.org/stable/c/3a905e183c047577b…
https://git.kernel.org/stable/c/98ea0039dbfdd00e5…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < e85a99db9ab85dfc30d93b0ca0e9156f3127f55a (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < 438a405fbad6882df0e34b3e1a16839a71f04240 (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < 6a6c07a9b49e43f0df42d7118fc76aa555c73d98 (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < eebd72cff518ac87e660aefb8a41224bd88c32ce (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < 4ef30b9f1641c9e877792df6b049f1cf507d002d (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < d4a594dd952df123cbdcdee9b9640d9d55e4a954 (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < 3a905e183c047577b154f08a78ac3039e9454703 (git) Affected: b59d0bae6ca30c496f298881616258f9cde0d9c6 , < 98ea0039dbfdd00e5cc1b9a8afa40434476c0955 (git)
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 5.10.251 , ≤ 5.10.* (semver) Unaffected: 5.15.201 , ≤ 5.15.* (semver) Unaffected: 6.1.164 , ≤ 6.1.* (semver) Unaffected: 6.6.127 , ≤ 6.6.* (semver) Unaffected: 6.12.74 , ≤ 6.12.* (semver) Unaffected: 6.18.13 , ≤ 6.18.* (semver) Unaffected: 6.19.3 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e85a99db9ab85dfc30d93b0ca0e9156f3127f55a",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "438a405fbad6882df0e34b3e1a16839a71f04240",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "6a6c07a9b49e43f0df42d7118fc76aa555c73d98",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "eebd72cff518ac87e660aefb8a41224bd88c32ce",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "4ef30b9f1641c9e877792df6b049f1cf507d002d",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "d4a594dd952df123cbdcdee9b9640d9d55e4a954",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "3a905e183c047577b154f08a78ac3039e9454703",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            },
            {
              "lessThan": "98ea0039dbfdd00e5cc1b9a8afa40434476c0955",
              "status": "affected",
              "version": "b59d0bae6ca30c496f298881616258f9cde0d9c6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.3",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix out-of-bounds access in sysfs attribute read/write\n\nSome f2fs sysfs attributes suffer from out-of-bounds memory access and\nincorrect handling of integer values whose size is not 4 bytes.\n\nFor example:\nvm:~# echo 65537 \u003e /sys/fs/f2fs/vde/carve_out\nvm:~# cat /sys/fs/f2fs/vde/carve_out\n65537\nvm:~# echo 4294967297 \u003e /sys/fs/f2fs/vde/atgc_age_threshold\nvm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold\n1\n\ncarve_out maps to {struct f2fs_sb_info}-\u003ecarve_out, which is a 8-bit\ninteger. However, the sysfs interface allows setting it to a value\nlarger than 255, resulting in an out-of-range update.\n\natgc_age_threshold maps to {struct atgc_management}-\u003eage_threshold,\nwhich is a 64-bit integer, but its sysfs interface cannot correctly set\nvalues larger than UINT_MAX.\n\nThe root causes are:\n1. __sbi_store() treats all default values as unsigned int, which\nprevents updating integers larger than 4 bytes and causes out-of-bounds\nwrites for integers smaller than 4 bytes.\n\n2. f2fs_sbi_show() also assumes all default values are unsigned int,\nleading to out-of-bounds reads and incorrect access to integers larger\nthan 4 bytes.\n\nThis patch introduces {struct f2fs_attr}-\u003esize to record the actual size\nof the integer associated with each sysfs attribute. With this\ninformation, sysfs read and write operations can correctly access and\nupdate values according to their real data size, avoiding memory\ncorruption and truncation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:02:56.280Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e85a99db9ab85dfc30d93b0ca0e9156f3127f55a"
        },
        {
          "url": "https://git.kernel.org/stable/c/438a405fbad6882df0e34b3e1a16839a71f04240"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a6c07a9b49e43f0df42d7118fc76aa555c73d98"
        },
        {
          "url": "https://git.kernel.org/stable/c/eebd72cff518ac87e660aefb8a41224bd88c32ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ef30b9f1641c9e877792df6b049f1cf507d002d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4a594dd952df123cbdcdee9b9640d9d55e4a954"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a905e183c047577b154f08a78ac3039e9454703"
        },
        {
          "url": "https://git.kernel.org/stable/c/98ea0039dbfdd00e5cc1b9a8afa40434476c0955"
        }
      ],
      "title": "f2fs: fix out-of-bounds access in sysfs attribute read/write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23235",
    "datePublished": "2026-03-04T14:36:39.537Z",
    "dateReserved": "2026-01-13T15:37:45.988Z",
    "dateUpdated": "2026-05-11T22:02:56.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23236 (GCVE-0-2026-23236)

Vulnerability from cvelistv5 – Published: 2026-03-04 14:36 – Updated: 2026-08-05 12:20

Title

fbdev: smscufx: properly copy ioctl memory to kernelspace

Summary

In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: properly copy ioctl memory to kernelspace The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the memory before accessing it within the kernel.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7018 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/061cfeb560aa3ddc1…
https://git.kernel.org/stable/c/6167af934f956d3ae…
https://git.kernel.org/stable/c/a0321e6e58facb39f…
https://git.kernel.org/stable/c/0634e8d650993602f…
https://git.kernel.org/stable/c/52917e265aa5f8482…
https://git.kernel.org/stable/c/1c008ad0f0d1c1523…
https://git.kernel.org/stable/c/f1e91bd4efeae48b0…
https://git.kernel.org/stable/c/120adae7b42faa641…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < 061cfeb560aa3ddc174153dbe5be9d0b55eb7248 (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < 6167af934f956d3ae1e06d61f45cd0d1004bbe1a (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < a0321e6e58facb39fe191caa0e52ed9aab6a48fe (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < 0634e8d650993602fc5b389ff7ac525f6542e141 (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < 52917e265aa5f848212f60fc50fc504d8ef12866 (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < 1c008ad0f0d1c1523902b9cdb08e404129677bfc (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02 (git) Affected: 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 , < 120adae7b42faa641179270c067864544a50ab69 (git)
Linux	Linux	Affected: 3.2 Unaffected: 0 , < 3.2 (semver) Unaffected: 5.10.251 , ≤ 5.10.* (semver) Unaffected: 5.15.201 , ≤ 5.15.* (semver) Unaffected: 6.1.164 , ≤ 6.1.* (semver) Unaffected: 6.6.127 , ≤ 6.6.* (semver) Unaffected: 6.12.74 , ≤ 6.12.* (semver) Unaffected: 6.18.13 , ≤ 6.18.* (semver) Unaffected: 6.19.3 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:01:07.977Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/smscufx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "061cfeb560aa3ddc174153dbe5be9d0b55eb7248",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "6167af934f956d3ae1e06d61f45cd0d1004bbe1a",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "a0321e6e58facb39fe191caa0e52ed9aab6a48fe",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "0634e8d650993602fc5b389ff7ac525f6542e141",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "52917e265aa5f848212f60fc50fc504d8ef12866",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "1c008ad0f0d1c1523902b9cdb08e404129677bfc",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            },
            {
              "lessThan": "120adae7b42faa641179270c067864544a50ab69",
              "status": "affected",
              "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/smscufx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.3",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: properly copy ioctl memory to kernelspace\n\nThe UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from\nuserspace to kernelspace, and instead directly references the memory,\nwhich can cause problems if invalid data is passed from userspace.  Fix\nthis all up by correctly copying the memory before accessing it within\nthe kernel."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered via a local ioctl syscall (UFX_IOCTL_REPORT_DAMAGE) on the /dev/fb* framebuffer device file. The USB device must be physically present but the attack itself is a local system call.\nAC:L - The attacker can reliably trigger the vulnerability with a single ioctl call. No race condition, special timing, or non-default configuration is required.\nPR:L - Opening /dev/fb* typically requires membership in the video group, which is a low-privilege requirement on desktop/workstation systems. No capabilities or root privileges are needed beyond device file access.\nUI:N - No user interaction is required. The attacker independently issues the ioctl to trigger the vulnerability.\nS:U - The vulnerability stays within the kernel\u0027s security scope \u2014 there is no escape from a VM, container, or other security boundary.\nC:L - On non-SMAP systems, the kernel reads 16 bytes (struct dloarea: x, y, w, h) from an attacker-controlled kernel address, providing a limited information disclosure primitive through side-channel observation of the subsequent conditional writes and USB transfer behavior.\nI:H - On non-SMAP systems, the kernel conditionally writes constrained values (0 or display resolution integers) to attacker-controlled kernel addresses, providing a write-what-where primitive. Writing 0 to arbitrary kernel addresses is a known exploitation technique for privilege escalation.\nA:H - On SMAP-enabled systems (most modern x86), the direct userspace pointer dereference causes a kernel oops or panic, reliably crashing the system. Even on non-SMAP systems, passing invalid addresses triggers a kernel fault."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:48.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/061cfeb560aa3ddc174153dbe5be9d0b55eb7248"
        },
        {
          "url": "https://git.kernel.org/stable/c/6167af934f956d3ae1e06d61f45cd0d1004bbe1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0321e6e58facb39fe191caa0e52ed9aab6a48fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/0634e8d650993602fc5b389ff7ac525f6542e141"
        },
        {
          "url": "https://git.kernel.org/stable/c/52917e265aa5f848212f60fc50fc504d8ef12866"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c008ad0f0d1c1523902b9cdb08e404129677bfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02"
        },
        {
          "url": "https://git.kernel.org/stable/c/120adae7b42faa641179270c067864544a50ab69"
        }
      ],
      "title": "fbdev: smscufx: properly copy ioctl memory to kernelspace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23236",
    "datePublished": "2026-03-04T14:36:40.162Z",
    "dateReserved": "2026-01-13T15:37:45.988Z",
    "dateUpdated": "2026-08-05T12:20:48.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23237 (GCVE-0-2026-23237)

Vulnerability from cvelistv5 – Published: 2026-03-04 14:38 – Updated: 2026-05-11 22:02

Title

platform/x86: classmate-laptop: Add missing NULL pointer checks

Summary

In the Linux kernel, the following vulnerability has been resolved: platform/x86: classmate-laptop: Add missing NULL pointer checks In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7018 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/993708fc18d0d0919…
https://git.kernel.org/stable/c/af673209d43b46257…
https://git.kernel.org/stable/c/eb214804f03c829de…
https://git.kernel.org/stable/c/9cf4b9b8ad09d6e05…
https://git.kernel.org/stable/c/da6e06a5fdbabea38…
https://git.kernel.org/stable/c/97528b1622b8f1295…
https://git.kernel.org/stable/c/fe747d7112283f471…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < 993708fc18d0d0919db438361b4e8c1f980a8d1b (git) Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < af673209d43b46257540997aba042b90ef3258c0 (git) Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < eb214804f03c829decf10998e9b7dd26f4c8ab9e (git) Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < 9cf4b9b8ad09d6e05307abc4e951cabdff4be652 (git) Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < da6e06a5fdbabea3870d18c227734b5dea5b3be6 (git) Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < 97528b1622b8f129574d29a571c32a3c85eafa3c (git) Affected: 529aa8cb0a59367d08883f818e8c47028e819d0d , < fe747d7112283f47169e9c16e751179a9b38611e (git)
Linux	Linux	Affected: 2.6.33 Unaffected: 0 , < 2.6.33 (semver) Unaffected: 5.10.251 , ≤ 5.10.* (semver) Unaffected: 5.15.201 , ≤ 5.15.* (semver) Unaffected: 6.1.164 , ≤ 6.1.* (semver) Unaffected: 6.6.127 , ≤ 6.6.* (semver) Unaffected: 6.12.74 , ≤ 6.12.* (semver) Unaffected: 6.18.13 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/classmate-laptop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "993708fc18d0d0919db438361b4e8c1f980a8d1b",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            },
            {
              "lessThan": "af673209d43b46257540997aba042b90ef3258c0",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            },
            {
              "lessThan": "eb214804f03c829decf10998e9b7dd26f4c8ab9e",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            },
            {
              "lessThan": "9cf4b9b8ad09d6e05307abc4e951cabdff4be652",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            },
            {
              "lessThan": "da6e06a5fdbabea3870d18c227734b5dea5b3be6",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            },
            {
              "lessThan": "97528b1622b8f129574d29a571c32a3c85eafa3c",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            },
            {
              "lessThan": "fe747d7112283f47169e9c16e751179a9b38611e",
              "status": "affected",
              "version": "529aa8cb0a59367d08883f818e8c47028e819d0d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/classmate-laptop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: classmate-laptop: Add missing NULL pointer checks\n\nIn a few places in the Classmate laptop driver, code using the accel\nobject may run before that object\u0027s address is stored in the driver\ndata of the input device using it.\n\nFor example, cmpc_accel_sensitivity_store_v4() is the \"show\" method\nof cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),\nbefore calling dev_set_drvdata() for inputdev-\u003edev.  If the sysfs\nattribute is accessed prematurely, the dev_get_drvdata(\u0026inputdev-\u003edev)\ncall in in cmpc_accel_sensitivity_store_v4() returns NULL which\nleads to a NULL pointer dereference going forward.\n\nMoreover, sysfs attributes using the input device are added before\ninitializing that device by cmpc_add_acpi_notify_device() and if one\nof them is accessed before running that function, a NULL pointer\ndereference will occur.\n\nFor example, cmpc_accel_sensitivity_attr_v4 is added before calling\ncmpc_add_acpi_notify_device() and if it is read prematurely, the\ndev_get_drvdata(\u0026acpi-\u003edev) call in cmpc_accel_sensitivity_show_v4()\nreturns NULL which leads to a NULL pointer dereference going forward.\n\nFix this by adding NULL pointer checks in all of the relevant places."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:02:58.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/993708fc18d0d0919db438361b4e8c1f980a8d1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/af673209d43b46257540997aba042b90ef3258c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb214804f03c829decf10998e9b7dd26f4c8ab9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cf4b9b8ad09d6e05307abc4e951cabdff4be652"
        },
        {
          "url": "https://git.kernel.org/stable/c/da6e06a5fdbabea3870d18c227734b5dea5b3be6"
        },
        {
          "url": "https://git.kernel.org/stable/c/97528b1622b8f129574d29a571c32a3c85eafa3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe747d7112283f47169e9c16e751179a9b38611e"
        }
      ],
      "title": "platform/x86: classmate-laptop: Add missing NULL pointer checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23237",
    "datePublished": "2026-03-04T14:38:41.815Z",
    "dateReserved": "2026-01-13T15:37:45.988Z",
    "dateUpdated": "2026-05-11T22:02:58.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23238 (GCVE-0-2026-23238)

Vulnerability from cvelistv5 – Published: 2026-03-04 14:38 – Updated: 2026-06-02 13:01

Title

romfs: check sb_set_blocksize() return value

Summary

In the Linux kernel, the following vulnerability has been resolved: romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh(): kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7018 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a381f0f61b35c8894…
https://git.kernel.org/stable/c/f2521ab1f63a8c244…
https://git.kernel.org/stable/c/2c5829cd8fbbc9156…
https://git.kernel.org/stable/c/cbd9931e645682206…
https://git.kernel.org/stable/c/9b203b8ddd7359270…
https://git.kernel.org/stable/c/4b71ad7676564a94e…
https://git.kernel.org/stable/c/ab7ad7abb3660c58f…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a381f0f61b35c8894b0bd0d6acef2d8f9b08b244 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f2521ab1f63a8c244f06a080319e5ff9a2e1bd95 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2c5829cd8fbbc91568c520b666898f57cdcb8cf6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cbd9931e6456822067725354d83446c5bb813030 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9b203b8ddd7359270e8a694d0584743555128e2c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4b71ad7676564a94ec5f7d18298f51e8ae53db73 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.251 , ≤ 5.10.* (semver) Unaffected: 5.15.201 , ≤ 5.15.* (semver) Unaffected: 6.1.164 , ≤ 6.1.* (semver) Unaffected: 6.6.127 , ≤ 6.6.* (semver) Unaffected: 6.12.74 , ≤ 6.12.* (semver) Unaffected: 6.18.13 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:01:09.124Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/romfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a381f0f61b35c8894b0bd0d6acef2d8f9b08b244",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f2521ab1f63a8c244f06a080319e5ff9a2e1bd95",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c5829cd8fbbc91568c520b666898f57cdcb8cf6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cbd9931e6456822067725354d83446c5bb813030",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9b203b8ddd7359270e8a694d0584743555128e2c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4b71ad7676564a94ec5f7d18298f51e8ae53db73",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/romfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nromfs: check sb_set_blocksize() return value\n\nromfs_fill_super() ignores the return value of sb_set_blocksize(), which\ncan fail if the requested block size is incompatible with the block\ndevice\u0027s configuration.\n\nThis can be triggered by setting a loop device\u0027s block size larger than\nPAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs\nfilesystem on that device.\n\nWhen sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the\ndevice has logical_block_size=32768, bdev_validate_blocksize() fails\nbecause the requested size is smaller than the device\u0027s logical block\nsize. sb_set_blocksize() returns 0 (failure), but romfs ignores this and\ncontinues mounting.\n\nThe superblock\u0027s block size remains at the device\u0027s logical block size\n(32768). Later, when sb_bread() attempts I/O with this oversized block\nsize, it triggers a kernel BUG in folio_set_bh():\n\n    kernel BUG at fs/buffer.c:1582!\n    BUG_ON(size \u003e PAGE_SIZE);\n\nFix by checking the return value of sb_set_blocksize() and failing the\nmount with -EINVAL if it returns 0."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:02:59.763Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a381f0f61b35c8894b0bd0d6acef2d8f9b08b244"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2521ab1f63a8c244f06a080319e5ff9a2e1bd95"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c5829cd8fbbc91568c520b666898f57cdcb8cf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbd9931e6456822067725354d83446c5bb813030"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b203b8ddd7359270e8a694d0584743555128e2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b71ad7676564a94ec5f7d18298f51e8ae53db73"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0"
        }
      ],
      "title": "romfs: check sb_set_blocksize() return value",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23238",
    "datePublished": "2026-03-04T14:38:42.477Z",
    "dateReserved": "2026-01-13T15:37:45.989Z",
    "dateUpdated": "2026-06-02T13:01:09.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CERTFR-2026-AVI-0291

Solutions

CVE-2026-23235 (GCVE-0-2026-23235)

CVE-2026-23236 (GCVE-0-2026-23236)

CVE-2026-23237 (GCVE-0-2026-23237)

CVE-2026-23238 (GCVE-0-2026-23238)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour