CVE-2026-63818
Received Received - Intake

F2FS Orphan Inode Entry Count Validation Flaw

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead. Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63818
EUVD
EUVD-2026-45484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the f2fs file system's orphan inode recovery process. When mounting a corrupted file system image, the kernel may incorrectly trust a maliciously large orphan block entry_count value. This causes the recovery loop to read beyond the intended inode array, interpreting unrelated data as inode numbers and triggering a kernel panic via f2fs_bug_on(). The fix validates the entry_count before processing to prevent this issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's F2FS filesystem and requires examining filesystem metadata. Detection involves checking for corrupted orphan inode entries in F2FS partitions. Use fsck.f2fs to validate filesystem integrity. Run: fsck.f2fs -f /dev/sdX where /dev/sdX is the F2FS partition. If corruption is suspected, enable kernel logging for F2FS errors by setting debug_mask in sysfs: echo 0x100 > /sys/fs/f2fs/<device>/debug_mask.

Check kernel logs for F2FS-related errors or panics: dmesg | grep -i f2fs. Monitor for mount failures with -EFSCORRUPTED errors. Validate superblock errors: cat /sys/fs/f2fs/<device>/errors.

Impact Analysis

If you use a Linux system with the f2fs file system and encounter a corrupted file system image, this vulnerability could cause your system to crash with a kernel panic during mount operations. This leads to unexpected downtime and potential data loss if the corruption is not detected early. Users should ensure their kernel is patched to avoid this risk.

Compliance Impact

This vulnerability could impact compliance by causing system crashes or data corruption during file system operations, potentially leading to violations of availability requirements in GDPR or HIPAA. Unpatched systems may fail to maintain data integrity and availability, which are critical for regulatory compliance. Organizations should apply the patch to mitigate these risks.

Mitigation Strategies

Apply the latest kernel patch fixing CVE-2026-63818. Reboot the system to load the patched kernel. If using F2FS, run fsck.f2fs -f on all F2FS partitions to repair potential corruption. Avoid mounting untrusted F2FS images until patched. Monitor for filesystem errors in kernel logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart