Linux Kernel Vulnerability in Flexible Inline Xattr Feature

CVE-2026-63815

What is CVE-2026-63815?

A vulnerability in the Linux kernel's handling of inline extended attributes allows an attacker to exploit the flexible_inline_xattr feature. When this feature is enabled, the do_read_inode() function loads the on-disk i_inline_xattr_size unconditionally, potentially leading to an out-of-bounds read. This occurs when an inode that lacks the FI_INLINE_XATTR flag still carries an inline directory, enabling a crafted image to manipulate the i_inline_xattr_size. As a result, functions like get_inline_xattr_addrs() may return unsafe values, allowing for unintended memory access and potential data corruption, affecting the integrity of the filesystem.

References