Linux Kernel CVE-2026-63816

Exploitation requires local access to a system with an F2FS filesystem mounted and the ability to use F2FS atomic-write (copy-on-write) files plus the F2FS_IOC_GARBAGE_COLLECT_RANGE ioctl - i.e., a cow_inode for which f2fs_is_cow_file() is true. The attacker must win a race between garbage collection (f2fs_gc/gc_data_segment/ra_data_block accessing atomic_inode->i_mapping) and concurrent f2fs_evict_inode() of that atomic_inode. Limiting factors: it is local-only (CVSS AV:L) and needs low privileges (PR:L) - not remote and not unauthenticated; it only affects kernels built with F2FS and running on an F2FS-mounted volume; and success depends on a timing-sensitive race, so it is non-deterministic and may require many attempts. Systems that do not mount F2FS or do not expose it to unprivileged users are not exploitable.

This is a real but bounded local-only issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) reflects local access with low privileges and high impact - consistent with a kernel UAF that can corrupt memory. However, several signals point to modest real-world urgency: EPSS is only 0.16% (5th percentile), the CVE is not on CISA KEV, and no public POC is referenced. The bug is a race condition, so reliable exploitation is non-trivial (the CVSS AC:L may understate practical difficulty of winning the eviction/GC race). Note also a conflict in the source tags: the input tags this as 'Information Disclosure,' but the code path describes a use-after-free driving a BUG_ON crash, which is primarily a denial-of-service and potential memory-corruption/privilege-escalation primitive rather than pure info disclosure - verify the impact classification with the kernel advisory. The C:H/I:H/A:H rating is the theoretical ceiling of a UAF; in practice a triggered BUG_ON most reliably yields a crash (DoS), with code-execution being possible but unproven here.

A local user on a system using an F2FS volume opens an atomic (copy-on-write) file and, from a second thread, repeatedly invokes ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) while racing inode eviction of the shared atomic_inode. Winning the race causes the GC path to populate a page mapping on a freed inode, corrupting kernel memory and crashing the host (DoS), with a UAF primitive that could theoretically be shaped toward privilege escalation. No public exploit is identified at time of analysis, and the race-condition nature makes reliable exploitation difficult.