Kernel Vulnerability in Linux Affecting F2FS Compression Feature

CVE-2026-63817

What is CVE-2026-63817?

A vulnerability exists in the Linux kernel affecting the F2FS (Flash-Friendly File System) compression feature. When the compress_cache option is disabled, the system fails to properly validate inode numbers associated with compressed page cache inodes, potentially leading to the instantiation of fake internal inodes. This occurs because the inode number treated as a meta inode bypasses necessary range checks. The flaw has been rectified to ensure that such inodes are only validated when the compress_cache option is enabled, thereby preventing out-of-range inode numbers from being accepted.

References