# CVE-2026-23233: f2fs: fix to avoid mapping wrong physical block for swapfile CVE-2026-23233 is fixed in 36 products on 1 platform, first by DEBIAN-CVE-2026-23233, released March 4, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-23233 - Priority: High - CVSS: 7.8 (Important) - EPSS: 0.0018 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 4, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23233 ## Description In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid mapping wrong physical block for swapfile Xiaolong Guo reported a f2fs bug in bugzilla [1] [1] https://bugzilla.kernel.org/show_bug.cgi?id=220951 Quoted: "When using stress-ng's swap stress test on F2FS filesystem with kernel 6.6+, the system experiences data corruption leading to either: 1 dm-verity corruption errors and device reboot 2 F2FS node corruption errors and boot hangs The issue occurs specifically when: 1 Using F2FS filesystem (ext4 is unaffected) 2 Swapfile size is less than F2FS section size (2MB) 3 Swapfile has fragmented physical layout (multiple non-contiguous extents) 4 Kernel version is 6.6+ (6.1 is unaffected) The root cause is in check_swap_activate() function in fs/f2fs/data.c. When the first extent of a small swapfile (< 2MB) is not aligned to section boundaries, the function incorrectly treats it as the last extent, failing to map subsequent extents. This results in incorrect swap_extent creation where only the first extent is mapped, causing subsequent swap writes to overwrite wrong physical locations (other files' data). Steps to Reproduce 1 Setup a device with F2FS-formatted userdata partition 2 Compile stress-ng from https://github.com/ColinIanKing/stress-ng 3 Run swap stress test: (Android devices) adb shell "cd /data/stressng; ./stress-ng-64 --metrics-brief --timeout 60 --swap 0" Log: 1 Ftrace shows in kernel 6.6, only first extent is mapped during second f2fs_map_blocks call in check_swap_activate(): stress-ng-swap-8990: f2fs_map_blocks: ino=11002, file offset=0, start blkaddr=0x43143, len=0x1 (Only 4KB mapped, not the full swapfile) 2 in kernel 6.1, both extents are correctly mapped: stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=0, start blkaddr=0x13cd4, len=0x1 stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=1, start blkaddr=0x60c84b, len=0xff The problematic code is in check_swap_activate(): if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec || nr_pblocks % blks_per_sec || !f2fs_valid_pinned_area(sbi, pblock)) { bool last_extent = false; not_aligned++; nr_pblocks = roundup(nr_pblocks, blks_per_sec); if (cur_lblock + nr_pblocks > sis->max) nr_pblocks -= blks_per_sec; /* this extent is last one */ if (!nr_pblocks) { nr_pblocks = last_lblock - cur_lblock; last_extent = true; } ret = f2fs_migrate_blocks(inode, cur_lblock, nr_pblocks); if (ret) { if (ret == -ENOENT) ret = -EINVAL; goto out; } if (!last_extent) goto retry; } When the first extent is unaligned and roundup(nr_pblocks, blks_per_sec) exceeds sis->max, we subtract blks_per_sec resulting in nr_pblocks = 0. The code then incorrectly assumes this is the last extent, sets nr_pblocks = last_lblock - cur_lblock (entire swapfile), and performs migration. After migration, it doesn't retry mapping, so subsequent extents are never processed. " In order to fix this issue, we need to lookup block mapping info after we migrate all blocks in the tail of swapfile. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | kernel-uek ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-core ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-core ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-core ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-core ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-devel ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-devel ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-core ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-core ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-deprecated ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-deprecated ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-desktop ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-desktop ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-extra ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-extra ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-extra-netfilter ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-extra-netfilter ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-usb ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-usb ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-wireless ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-debug-modules-wireless ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-devel ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-devel ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-doc ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-doc ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-core ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-core ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-deprecated ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-deprecated ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-desktop ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-desktop ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-extra ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-extra ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-extra-netfilter ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-extra-netfilter ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-usb ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-usb ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-wireless ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-modules-wireless ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-tools ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek-tools ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-core ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-core ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-devel ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-devel ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-core ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-core ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-deprecated ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-deprecated ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-desktop ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-desktop ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-extra ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-extra ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-extra-netfilter ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-extra-netfilter ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-usb ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-usb ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-wireless ol 10 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | kernel-uek64k-modules-wireless ol 9 | 0:6.12.0-200.74.27.el9uek | [ELSA-2026-50160](https://patchblox.com/security/data/fix/linux/elsa-2026-50160.md) | Mar 20, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.74-2 | [DEBIAN-CVE-2026-23233](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23233.md) | Mar 4, 2026 | | Linux | linux Debian 14 | 6.18.13-1 | [DEBIAN-CVE-2026-23233](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23233.md) | Mar 4, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.