CVE-2026-63814
Received Received - Intake

ACL Validation Flaw in Linux Kernel f2fs

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fs_acl_from_disk() f2fs_acl_count() only validates the aggregate ACL xattr length. A malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk() then reads entry->e_id before verifying that a full entry fits. Require a short entry before reading e_tag and e_perm, and require a full entry before reading e_id for ACL_USER and ACL_GROUP. Return -EFSCORRUPTED from these new truncated-entry checks, while keeping the pre-existing -EINVAL paths unchanged. Validation reproduced this kernel report: KASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0 RIP: 0033:0x7f4b835ea7aa The buggy address belongs to the object at ffff888114589960 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888114589960, ffff888114589968) Read of size 4 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x224/0x430 (?:?) kasan_report+0xe0/0x110 (?:?) __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169) __get_acl+0x281/0x380 (?:?) vfs_get_acl+0x10b/0x190 (?:?) do_get_acl+0x2a/0x410 (?:?) do_get_acl+0x9/0x410 (?:?) do_getxattr+0xe8/0x260 (?:?) filename_getxattr+0xd1/0x140 (?:?) do_getname+0x2d/0x2d0 (?:?) path_getxattrat+0x16c/0x200 (?:?) lock_release+0xc8/0x290 (?:?) cgroup_update_frozen+0x9d/0x320 (?:?) lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?) trace_hardirqs_on+0x1a/0x170 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63814
EUVD
EUVD-2026-45480

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel f2fs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of ACL (Access Control List) entry sizes in the f2fs file system. A malformed ACL can cause the kernel to read memory outside allocated bounds when processing ACL_USER or ACL_GROUP entries, leading to a slab-out-of-bounds error.

Detection Guidance

This vulnerability affects the Linux kernel's f2fs file system ACL handling. Detection requires checking kernel logs for slab-out-of-bounds errors or KASAN reports related to f2fs_acl_from_disk. Monitor for crashes in processes accessing f2fs files with malformed ACLs.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash or execute arbitrary code with elevated privileges by exploiting the memory corruption. It may also lead to data corruption or denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability in the Linux kernel's f2fs file system ACL handling could potentially lead to unauthorized access or data corruption if exploited. While not directly tied to GDPR or HIPAA, such vulnerabilities may violate compliance requirements for data integrity and access control in regulated environments.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, disable ACL support for f2fs mounts or restrict access to f2fs file systems until patched. Monitor kernel logs for exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart