What is the CVSS score of CVE-2026-63816?

CVE-2026-63816 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63816?

A memory corruption vulnerability in the Linux kernel's F2FS filesystem allows unprivileged local users to crash systems running this filesystem, impacting availability of containerized…. A patch is available.

How to fix or mitigate CVE-2026-63816?

Within 24 hours, identify all systems running F2FS-mounted volumes and document their current kernel versions by checking /proc/version or running uname -r. Within 7 days, deploy patched kernel updates to non-critical systems first, verifying stability and compatibility; consult your Linux distribution's security advisories for the specific kernel version addressing CVE-2026-63816. Within 30 days, complete rollout of patched kernels to all production systems using F2FS, prioritizing those serving multiple users or tenants.

Linux Kernel CVE-2026-63816

EUVD-2026-45482 HIGH

2026-07-19 Linux

GHSA-gp48-qw68-qgg5

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.3 MEDIUM

Local, low-priv trigger via ioctl; AC:H because it is a timing race; UAF corrupts memory (I:H) and reliably crashes (A:H), with no direct confidentiality disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:41 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:02 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
f2fs_gc
gc_data_segment
ra_data_block(cow_inode)
mapping = F2FS_I(inode)->atomic_inode->i_mapping

: f2fs_is_cow_file(cow_inode) is true

f2fs_evict_inode(atomic_inode)
clear_inode_flag(fi->cow_inode, FI_COW_FILE)
F2FS_I(fi->cow_inode)->atomic_inode = NULL

...

truncate_inode_pages_final(atomic_inode)
f2fs_grab_cache_folio(mapping)

: create folio in atomic_inode->mapping

clear_inode(atomic_inode)
BUG_ON(atomic_inode->i_data.nrpages)

We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.

AnalysisAI

Local privilege-adjacent memory corruption in the Linux kernel's F2FS filesystem allows a low-privileged user with access to an F2FS-mounted volume to trigger a use-after-free on the atomic_inode structure. During garbage collection of an atomic (copy-on-write) file via ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE), a race with concurrent inode eviction lets the kernel dereference and populate the page mapping of an already-freed atomic_inode, corrupting kernel memory and typically causing a BUG_ON/crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and this is not on CISA KEV. A vendor fix that takes a reference on fi->atomic_inode before use has been merged upstream.

Technical ContextAI

F2FS (Flash-Friendly File System) is a mainline Linux filesystem optimized for NAND/flash storage. It supports atomic writes through a copy-on-write (COW) mechanism: a 'cow_inode' backs staged writes and references a shared atomic_inode whose i_mapping (page cache) holds the atomic data. The bug is a classic use-after-free (CWE-416): the garbage collection path (f2fs_gc -> gc_data_segment -> ra_data_block) reads F2FS_I(inode)->atomic_inode->i_mapping and grabs a cache folio in that mapping, but a concurrent f2fs_evict_inode() can clear FI_COW_FILE, set atomic_inode to NULL, and run truncate_inode_pages_final()/clear_inode() on the atomic_inode. Because GC never took a reference on fi->atomic_inode, it operates on freed memory; the subsequent folio creation adds a page to a mapping under teardown, tripping BUG_ON(atomic_inode->i_data.nrpages) in clear_inode(). The root cause is missing reference counting on a shared inode across the GC and eviction paths.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.96, 6.18.39, 7.1.3, or 7.2-rc1 (or later), which correspond to the merged fix that acquires a reference on fi->atomic_inode before dereferencing its i_mapping during GC. The relevant stable commits are 56038756aae68312df00d4aa1d97e51ef3aca725, a805fec35c201c59643ddcde713bce4051c8ee27, a499f77c06050a28c897bdbd86cd2f0721ae0743, and e0288584baa5dc41df4a829a023c4c1b33fe53d7 (https://git.kernel.org/stable/c/56038756aae68312df00d4aa1d97e51ef3aca725). Where immediate patching is not possible, compensating controls include avoiding use of the F2FS filesystem for untrusted local workloads (mount alternative filesystems for user-writable volumes), and restricting local user access to F2FS-mounted volumes since exploitation requires local access to trigger the atomic-write GC path; note these controls reduce functionality for legitimate F2FS/atomic-write users. Because triggering depends on the F2FS_IOC_GARBAGE_COLLECT_RANGE ioctl against COW files, environments that do not expose F2FS to unprivileged users are not practically exposed.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63816 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63816

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code