Linux Kernel Vulnerability Affecting F2FS File System by Linux Foundation

CVE-2026-63818

What is CVE-2026-63818?

A flaw in the Linux kernel's f2fs module allows for improper validation of orphan inode entry counts. When replaying orphan inodes from the checkpoint pack, a corrupted entry count can cause the system to read beyond the ino[] array, potentially interpreting unrelated data as inode numbers. This misrepresents the orphan recovery process and may lead to a kernel panic. The recommended fix includes validating the entry count prior to consumption, ensuring that corrupted data results in an error state that prompts a file system check, thereby improving the resilience of the kernel against such corrupted checkpoint data.

References