CVE-2026-23223

HighCVSS 7.8/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix UAF in xchk_btree_check_block_owner

We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= ec793e690f801d97a7ae2a0d429fea1fee4d44aa, < 1d411278dda293a507cb794db7d9ed3511c685c6; >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa, < ed82e7949f5cac3058f4100f3cd670531d41a266; >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa, < ba5264610423d9653aa36920520902d83841bcfd; >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa, < 1c253e11225bc5167217897885b85093e17c2217
LinuxLinux6.9

References

Timeline

Published
Feb 18, 2026
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-232247.8In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.CVE-2026-232257.8In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't assume CID is CPU owned on mode switch Shinichiro rCVE-2026-232267.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_lCVE-2026-232277.8In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member vCVE-2026-232285.5In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() CVE-2026-232295.5In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification WCVE-2026-23234.3Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a craCVE-2026-232305.5In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races CVE-2026-232317.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_taCVE-2026-232325.5In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()" TCVE-2026-232337.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid mapping wrong physical block for swapfile Xiaolong CVE-2026-232347.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an us
CVE-2026-23223: High severity, CVSS 7.8 | Vulnix