CVE-2026-63815 (GCVE-0-2026-63815)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally: if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size); but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image. get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry: MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...) addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area: while (bit_pos < d->max) /* fs/f2fs/dir.c */ ... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ... Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files. Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 3c8d6b4093aea40a20596f452289e7c22d84e6d5 (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < a08ee30dcbeff6b97df75c38c2589603ddde53a6 (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < c3e05522daae4e7348a1ea81eeb321d25aa0fd3b (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 76e1a05cf6d4051931d7fa4ead51a05786a62918 (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706 (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 16bc237ce3c483b75575abea53cfb639745311ed (git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c8d6b4093aea40a20596f452289e7c22d84e6d5",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "a08ee30dcbeff6b97df75c38c2589603ddde53a6",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "c3e05522daae4e7348a1ea81eeb321d25aa0fd3b",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "76e1a05cf6d4051931d7fa4ead51a05786a62918",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "16bc237ce3c483b75575abea53cfb639745311ed",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "378acf3cf19b6af6cba55e8dd1154c4e1504bae8",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size = le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set.  An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA()  = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page()   = CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue.  The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size == 0 are still accepted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (mount on a block/loop device, then getdents/lookup on an inline directory); f2fs is not reachable via a network-facing in-kernel protocol handler.\nAC:L - The attacker fully controls the on-disk inode fields in a crafted f2fs image and can reliably trigger the bug by mounting that image and reading the directory; no race or rare runtime state is required.\nPR:N - An attacker can craft a malicious f2fs image offline with no privileges on the target system; exploitation is triggered when the image is mounted and its inline directory is read, including by privileged auto-mount services on shared/kiosk systems.\nUI:N - No victim user action beyond the attacker\u0027s own mount and directory read is required; an attacker with user-namespace mount capability can self-trigger without involving another user.\nS:U - Impact is kernel memory corruption and information disclosure within the same kernel security boundary, not a cross-boundary escape such as guest-to-host VM breakout.\nC:H - The corrupted geometry drives out-of-bounds reads via test_bit_le(), dentry, and filename pointer accesses far beyond the inline data area, enabling kernel memory disclosure.\nI:H - Integer underflow in inode geometry also corrupts ADDRS_PER_INODE/addrs_per_page calculations for regular files, creating memory corruption that can be leveraged for out-of-bounds writes and further exploitation.\nA:H - Reading far past the inline area can cause kernel oops or panic, and the corrupted address calculations can crash or destabilize the kernel during subsequent file operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:22.389Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d"
        },
        {
          "url": "https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8"
        }
      ],
      "title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63815",
    "datePublished": "2026-07-19T12:02:15.345Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-17T04:51:22.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63815",
      "date": "2026-09-20",
      "epss": "0.00139",
      "percentile": "0.03679"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:15:06.000Z",
      "cve": "CVE-2026-63815",
      "id": "msrc_CVE-2026-63815",
      "initial_release_date": "2026-07-20T01:01:23.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63815.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c8d6b4093aea40a20596f452289e7c22d84e6d5",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a08ee30dcbeff6b97df75c38c2589603ddde53a6",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3e05522daae4e7348a1ea81eeb321d25aa0fd3b",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "76e1a05cf6d4051931d7fa4ead51a05786a62918",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16bc237ce3c483b75575abea53cfb639745311ed",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "378acf3cf19b6af6cba55e8dd1154c4e1504bae8",
                    "status": "affected",
                    "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size = le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set.  An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA()  = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page()   = CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue.  The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size == 0 are still accepted."
          }
        ],
        "id": "CVE-2026-63815",
        "lastModified": "2026-08-17T05:17:18.723",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T12:16:54.527",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:02:06+00:00",
      "cve": "CVE-2026-63815",
      "id": "CVE-2026-63815",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63815.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T13:04:54Z",
      "cve": "CVE-2026-63815",
      "id": "CVE-2026-63815",
      "initial_release_date": "2026-07-19T17:34:50Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63815",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63815.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.