{
  "cveId": "CVE-2026-23267",
  "url": "https://patchblox.com/security/cve/CVE-2026-23267",
  "summary": "CVE-2026-23267 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-23267, released March 18, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes  During SPO tests, when mounting F2FS, an -EINVAL error was returned from f2fs_recover_inode_page. The issue occurred under the following scenario  Thread A                                     Thread B f2fs_ioc_commit_atomic_write  - f2fs_do_sync_file // atomic = true   - f2fs_fsync_node_pages     : last_folio = inode folio     : schedule before folio_lock(last_folio) f2fs_write_checkpoint                                               - block_operations// writeback last_folio                                               - schedule before f2fs_flush_nat_entries     : set_fsync_mark(last_folio, 1)     : set_dentry_mark(last_folio, 1)     : folio_mark_dirty(last_folio)     - __write_node_folio(last_folio)       : f2fs_down_read(\u0026sbi-\u003Enode_write)//block                                               - f2fs_flush_nat_entries                                                 : {struct nat_entry}-\u003Eflag |= BIT(IS_CHECKPOINTED)                                               - unblock_operations                                                 : f2fs_up_write(\u0026sbi-\u003Enode_write)                                              f2fs_write_checkpoint//return       : f2fs_do_write_node_page() f2fs_ioc_commit_atomic_write//return                                              SPO  Thread A calls f2fs_need_dentry_mark(sbi, ino), and the last_folio has already been written once. However, the {struct nat_entry}-\u003Eflag did not have the IS_CHECKPOINTED set, causing set_dentry_mark(last_folio, 1) and write last_folio again after Thread B finishes f2fs_write_checkpoint.  After SPO and reboot, it was detected that {struct node_info}-\u003Eblk_addr was not NULL_ADDR because Thread B successfully write the checkpoint.  This issue only occurs in atomic write scenarios. For regular file fsync operations, the folio must be dirty. If block_operations-\u003Ef2fs_sync_node_pages successfully submit the folio write, this path will not be executed. Otherwise, the f2fs_write_checkpoint will need to wait for the folio write submission to complete, as sbi-\u003Enr_pages[F2FS_DIRTY_NODES] \u003E 0. Therefore, the situation where f2fs_need_dentry_mark checks that the {struct nat_entry}-\u003Eflag /wo the IS_CHECKPOINTED flag, but the folio write has already been submitted, will not occur.  Therefore, for atomic file fsync, sbi-\u003Enode_write should be acquired through __write_node_folio to ensure that the IS_CHECKPOINTED flag correctly indicates that the checkpoint write has been completed.",
  "published": "2026-03-18T18:16:25Z",
  "severity": "Important",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00121,
  "epssPercentile": 0.01939,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23267",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.164-1",
      "fix": "DEBIAN-CVE-2026-23267",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23267",
      "released": "2026-03-18T18:16:25Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.74-1",
      "fix": "DEBIAN-CVE-2026-23267",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23267",
      "released": "2026-03-18T18:16:25Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.13-1",
      "fix": "DEBIAN-CVE-2026-23267",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23267",
      "released": "2026-03-18T18:16:25Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}