CVE-2026-63818: f2fs: validate orphan inode entry count
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate orphan inode entry count
f2fsrecoverorphaninodes() trusts the orphan block entrycount when replaying orphan inodes from the checkpoint pack. A corrupted entrycount larger than F2FSORPHANSPERBLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fsbugon() and panic the kernel. Validate entrycount before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.
Set ERRORINCONSISTENTORPHAN as well, so the corruption reason can be recorded in the superblock serrors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBINEEDFSCK through a checkpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63818?
CVE-2026-63818 has a high severity rating of 8.4 according to CVSS 3.1.
How does CVE-2026-63818 impact the Linux Kernel?
CVE-2026-63818 allows for the possibility of exploiting a corrupted orphan inode entry count, which could lead to data corruption.
How do I fix CVE-2026-63818?
To mitigate CVE-2026-63818, you should upgrade to the latest patched version of the Linux Kernel provided by the Linux Kernel Project.
What versions of the Linux Kernel are affected by CVE-2026-63818?
CVE-2026-63818 affects certain versions of the Linux Kernel prior to the fix implemented on July 20, 2026.
Can CVE-2026-63818 lead to denial of service?
Yes, CVE-2026-63818 can potentially lead to denial of service due to exploitation of the orphan inode entry count.