CVE-2026-93816: f2fs: validate inline dentry name lengths before conversion
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate inline dentry name lengths before conversion
Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots.
A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block.
Validate each inline dentry name length against the inline filename area before copying it.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that mount or process a corrupted F2FS filesystem image are exposed when the inline dentry conversion path is reached. The issue is in the Linux kernel's F2FS handling rather than in ordinary filename processing alone.
What does an attacker need to exploit it?
An attacker needs to provide or cause use of a corrupted F2FS image containing inline dentries with recorded name lengths that exceed the available inline filename storage. Exploitation requires the kernel to perform inline dentry conversion on that filesystem data.
How can I determine whether a filesystem image is affected?
Inspect the image's inline dentries for recorded filename lengths that do not fit within the available inline filename slots. An affected image contains malformed length values that would cause conversion to copy beyond inline filename storage.