CVE-2026-63818

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-63818
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead. Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a Patch
https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c Patch
https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280 Patch
https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b Patch
https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091 Patch
https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd Patch
https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70 Patch
https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

10 Nov 2026, 21:15

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a - () https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a - Patch
References () https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c - () https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c - Patch
References () https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280 - () https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280 - Patch
References () https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b - () https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b - Patch
References () https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091 - () https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091 - Patch
References () https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd - () https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd - Patch
References () https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70 - () https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70 - Patch
References () https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f - () https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f - Patch
First Time Linux linux Kernel
Linux
CWE CWE-125
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Information

Published : 2026-07-19 12:16

Updated : 2026-11-10 21:15

NVD link : CVE-2026-63818

Mitre link : CVE-2026-63818

CVE.ORG link : CVE-2026-63818

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read