CVE-2026-23234

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid UAF in f2fswriteend_io()

As syzbot reported an use-after-free issue in f2fswriteend_io().

It is caused by below race condition:

loop device umount - workerthread - loopprocesswork - doreqfilebacked - lorwaio - lorwaiocomplete - blkmqendrequest - blkupdaterequest - f2fswriteendio - decpagecount - folioendwriteback - killf2fssuper - killblocksuper - f2fsputsuper : free(sbi) : getpages(, F2FSWBCPDATA) accessed sbi which is freed

In killf2fssuper(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folioendwriteback().

Let's relocate ckpt thread wakeup flow before folioendwriteback() to resolve this issue.