CVE-2026-63820: f2fs: fix missing read bio submission on large folio error
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix missing read bio submission on large folio error
f2fsreaddatalargefolio() can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folioinbio is false and the current error path returns immediately after ending that folio.
This can leave the bio accumulated for earlier folios unsubmitted. Those folios then never receive read completion, and readers can wait indefinitely on the locked folios.
Route errors through the common out path so any pending bio is submitted before returning. Stop consuming more readahead folios once an error is seen, and only wait on and clear the current folio when it was actually added to the bio.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the described behavior changes in the f2fs read path: route errors through the common out path so any pending bio is submitted; stop consuming more readahead folios once an error is seen; and only wait on and clear the current folio when it was actually processed (to prevent locked folios with missing read completion).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63820?
The severity of CVE-2026-63820 is rated at risk level 23.
How do I fix CVE-2026-63820?
To fix CVE-2026-63820, ensure that your Linux Kernel is updated to the latest version that includes the provided patches.
What impact does CVE-2026-63820 have on the Linux Kernel?
CVE-2026-63820 can lead to issues with bio submissions during read operations on large folios, potentially affecting data integrity.
Is CVE-2026-63820 a local or remote vulnerability?
CVE-2026-63820 is generally considered a local vulnerability as it requires access to the affected system.
When was CVE-2026-63820 published?
CVE-2026-63820 was published on July 19, 2026.