CVE-2026-63820
Received Received - Intake

Linux Kernel F2FS Read Bio Submission Flaw

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fs_read_data_large_folio() can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folio_in_bio is false and the current error path returns immediately after ending that folio. This can leave the bio accumulated for earlier folios unsubmitted. Those folios then never receive read completion, and readers can wait indefinitely on the locked folios. Route errors through the common out path so any pending bio is submitted before returning. Stop consuming more readahead folios once an error is seen, and only wait on and clear the current folio when it was actually added to the bio.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63820
EUVD
EUVD-2026-45486

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the f2fs file system's handling of read operations on large folios. When processing multiple readahead folios, an error in a later folio could prevent a pending read bio from being submitted, causing readers to wait indefinitely for locked folios that never complete their read operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's f2fs filesystem and does not have network-based detection methods. To detect it, check your kernel version for affected releases and monitor filesystem errors in system logs. Commands like 'uname -r' to check kernel version and 'dmesg | grep f2fs' to review filesystem errors may help.

Impact Analysis

This vulnerability could lead to system hangs or unresponsive applications if processes are stuck waiting for folios that never complete their read operations due to the unhandled error state.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel filesystem issue causing indefinite reader waits due to unsubmitted read bios, which may indirectly impact system availability but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling the f2fs filesystem if not in use or restricting access to systems using f2fs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart