CVE-2026-63817 (GCVE-0-2026-63817)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
f2fs: validate compress cache inode only when enabled
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress_cache mount option is enabled. When compress_cache is disabled, max_nid is outside the valid inode range. A corrupted directory entry that points to ino == max_nid should therefore be rejected by f2fs_check_nid_range(). However, is_meta_ino() currently treats F2FS_COMPRESS_INO() as a meta inode unconditionally, so f2fs_iget() bypasses do_read_inode() and its nid range check, and instantiates a fake internal inode instead. Gate the compressed cache inode case on COMPRESS_CACHE, matching f2fs_init_compress_inode(). With compress_cache disabled, ino == max_nid now follows the normal inode path and is rejected as an out-of-range nid.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < fcc051d377a9701a452e7663a1a8223c26225df9 (git)
Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < 29115b8c9172d34e67ab26cc4f6c209b7a236d7a (git)
Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < 13e4b59d3a9413f66f116fa6c4828519b960a5ea (git)
Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < 16161444c30d8dff9428abbae42b72ce4e32a932 (git)
Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < 77f216ff9ce5cde8eed9f6d12707e906dffdc9f7 (git)
Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < 0969926d987bbde9a1aa49da317582ba37095805 (git)
Affected: 6ce19aff0b8cd386860855185c6cd79337fc4d2b , < 5073c66a96a9c23c0c2533ed4ed06e42f9021208 (git)
Affected: a23706426da9b611be5beae0f3faa260fb453b4e (git)
Affected: 5.13.19 , < 5.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.177 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fcc051d377a9701a452e7663a1a8223c26225df9",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "lessThan": "29115b8c9172d34e67ab26cc4f6c209b7a236d7a",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "lessThan": "13e4b59d3a9413f66f116fa6c4828519b960a5ea",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "lessThan": "16161444c30d8dff9428abbae42b72ce4e32a932",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "lessThan": "77f216ff9ce5cde8eed9f6d12707e906dffdc9f7",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "lessThan": "0969926d987bbde9a1aa49da317582ba37095805",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "lessThan": "5073c66a96a9c23c0c2533ed4ed06e42f9021208",
              "status": "affected",
              "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a23706426da9b611be5beae0f3faa260fb453b4e",
              "versionType": "git"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.19",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate compress cache inode only when enabled\n\nF2FS_COMPRESS_INO() uses NM_I(sbi)-\u003emax_nid as the synthetic inode\nnumber for the compressed page cache inode. That inode only exists when\nthe compress_cache mount option is enabled.\n\nWhen compress_cache is disabled, max_nid is outside the valid inode\nrange. A corrupted directory entry that points to ino == max_nid should\ntherefore be rejected by f2fs_check_nid_range(). However, is_meta_ino()\ncurrently treats F2FS_COMPRESS_INO() as a meta inode unconditionally,\nso f2fs_iget() bypasses do_read_inode() and its nid range check, and\ninstantiates a fake internal inode instead.\n\nGate the compressed cache inode case on COMPRESS_CACHE, matching\nf2fs_init_compress_inode(). With compress_cache disabled, ino ==\nmax_nid now follows the normal inode path and is rejected as an\nout-of-range nid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local VFS operations (open/lookup, get_parent, mount-time recovery, and background GC) on a mounted F2FS filesystem; there is no direct network packet handler, though NFS export is a secondary path still requiring local filesystem access to plant corruption.\nAC:L - An attacker can deterministically craft an F2FS image with a directory entry pointing at ino=max_nid (known at image creation) and reliably trigger f2fs_iget() on mount or lookup without depending on uncontrollable runtime conditions.\nPR:L - Triggering requires mounting or writing to F2FS, which needs CAP_SYS_ADMIN but is obtainable by an unprivileged user via user namespaces; planting a corrupted dentry also requires only low-privilege write access to the filesystem.\nUI:N - Once a crafted or corrupted filesystem is in place, exploitation is driven entirely by attacker-initiated syscalls (mount, lookup, open) or automatic kernel paths (GC, recovery) with no victim interaction required.\nS:U - Impact is confined to kernel memory/filesystem integrity on the host running the affected F2FS code; it does not cross a VM, container, or IOMMU security boundary in the manner of a guest-to-host escape.\nC:H - Bypassing inode validation instantiates a mis-typed, uninitialized inode that subsequent f2fs data and node paths operate on, creating a type-confusion condition that can be leveraged for arbitrary kernel memory read primitives.\nI:H - The fake compress-cache inode is wired with compress address_space operations and skips normal inode teardown, enabling type confusion that can be abused for arbitrary kernel memory writes or control-flow hijacking.\nA:H - Operating on an invalid synthetic inode in GC, recovery, or lookup paths can trigger kernel oops, EFSCORRUPTED error handling, or filesystem panic (errors=panic), causing denial of service or system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:24.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fcc051d377a9701a452e7663a1a8223c26225df9"
        },
        {
          "url": "https://git.kernel.org/stable/c/29115b8c9172d34e67ab26cc4f6c209b7a236d7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/13e4b59d3a9413f66f116fa6c4828519b960a5ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/16161444c30d8dff9428abbae42b72ce4e32a932"
        },
        {
          "url": "https://git.kernel.org/stable/c/77f216ff9ce5cde8eed9f6d12707e906dffdc9f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0969926d987bbde9a1aa49da317582ba37095805"
        },
        {
          "url": "https://git.kernel.org/stable/c/5073c66a96a9c23c0c2533ed4ed06e42f9021208"
        }
      ],
      "title": "f2fs: validate compress cache inode only when enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63817",
    "datePublished": "2026-07-19T12:02:16.441Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-17T04:51:24.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63817",
      "date": "2026-09-21",
      "epss": "0.00134",
      "percentile": "0.03262"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-12T23:53:02.000Z",
      "cve": "CVE-2026-63817",
      "id": "msrc_CVE-2026-63817",
      "initial_release_date": "2026-07-20T01:06:49.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: validate compress cache inode only when enabled",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63817.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fcc051d377a9701a452e7663a1a8223c26225df9",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29115b8c9172d34e67ab26cc4f6c209b7a236d7a",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "13e4b59d3a9413f66f116fa6c4828519b960a5ea",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16161444c30d8dff9428abbae42b72ce4e32a932",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77f216ff9ce5cde8eed9f6d12707e906dffdc9f7",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0969926d987bbde9a1aa49da317582ba37095805",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5073c66a96a9c23c0c2533ed4ed06e42f9021208",
                    "status": "affected",
                    "version": "6ce19aff0b8cd386860855185c6cd79337fc4d2b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a23706426da9b611be5beae0f3faa260fb453b4e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "affected",
                    "version": "5.13.19",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate compress cache inode only when enabled\n\nF2FS_COMPRESS_INO() uses NM_I(sbi)-\u003emax_nid as the synthetic inode\nnumber for the compressed page cache inode. That inode only exists when\nthe compress_cache mount option is enabled.\n\nWhen compress_cache is disabled, max_nid is outside the valid inode\nrange. A corrupted directory entry that points to ino == max_nid should\ntherefore be rejected by f2fs_check_nid_range(). However, is_meta_ino()\ncurrently treats F2FS_COMPRESS_INO() as a meta inode unconditionally,\nso f2fs_iget() bypasses do_read_inode() and its nid range check, and\ninstantiates a fake internal inode instead.\n\nGate the compressed cache inode case on COMPRESS_CACHE, matching\nf2fs_init_compress_inode(). With compress_cache disabled, ino ==\nmax_nid now follows the normal inode path and is rejected as an\nout-of-range nid."
          }
        ],
        "id": "CVE-2026-63817",
        "lastModified": "2026-08-17T05:17:19.003",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T12:16:54.757",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0969926d987bbde9a1aa49da317582ba37095805"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/13e4b59d3a9413f66f116fa6c4828519b960a5ea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/16161444c30d8dff9428abbae42b72ce4e32a932"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/29115b8c9172d34e67ab26cc4f6c209b7a236d7a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5073c66a96a9c23c0c2533ed4ed06e42f9021208"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77f216ff9ce5cde8eed9f6d12707e906dffdc9f7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fcc051d377a9701a452e7663a1a8223c26225df9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:01:27+00:00",
      "cve": "CVE-2026-63817",
      "id": "CVE-2026-63817",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: validate compress cache inode only when enabled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63817.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-21T13:04:51Z",
      "cve": "CVE-2026-63817",
      "id": "CVE-2026-63817",
      "initial_release_date": "2026-07-19T17:34:48Z",
      "product_status:known_affected": "207",
      "product_status:known_not_affected": "77",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63817",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63817.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.