What is the CVSS score of CVE-2026-63817?

CVE-2026-63817 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63817?

A high-severity vulnerability in the Linux kernel's F2FS filesystem (CVE-2026-63817) allows bypass of inode validation on systems with compress_cache disabled, enabling local privilege escalation or…. A patch is available.

How to fix or mitigate CVE-2026-63817?

Within 24 hours, identify and enumerate all systems in your infrastructure running the Linux kernel with F2FS filesystem enabled and compress_cache mount option explicitly disabled. Within 7 days, obtain and test the available vendor patch in a non-production environment, then schedule kernel updates for affected systems. Within 30 days, complete deployment of patched kernels across all production infrastructure and validate that the patch has been successfully applied via kernel version verification.

Linux Kernel CVE-2026-63817

EUVD-2026-45483 HIGH

2026-07-19 Linux

GHSA-cv79-fx5q-34h3

Authentication Bypass Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local trigger via a mounted crafted f2fs image (AV:L); mounting untrusted media typically needs some privilege/automount (PR:L); validation bypass yields kernel memory corruption with full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:41 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:02 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate compress cache inode only when enabled

F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress_cache mount option is enabled.

When compress_cache is disabled, max_nid is outside the valid inode range. A corrupted directory entry that points to ino == max_nid should therefore be rejected by f2fs_check_nid_range(). However, is_meta_ino() currently treats F2FS_COMPRESS_INO() as a meta inode unconditionally, so f2fs_iget() bypasses do_read_inode() and its nid range check, and instantiates a fake internal inode instead.

Gate the compressed cache inode case on COMPRESS_CACHE, matching f2fs_init_compress_inode(). With compress_cache disabled, ino == max_nid now follows the normal inode path and is rejected as an out-of-range nid.

AnalysisAI

Improper inode validation in the Linux kernel's F2FS filesystem allows a crafted or corrupted f2fs image to smuggle a directory entry referencing the synthetic compressed-cache inode number (max_nid), bypassing f2fs_check_nid_range() when the compress_cache mount option is disabled. Because is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode, f2fs_iget() skips do_read_inode() and instantiates a fake internal inode instead of rejecting the out-of-range nid, enabling local memory-safety abuse. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not on CISA KEV.

Technical ContextAI

F2FS (Flash-Friendly File System) is a log-structured filesystem in the Linux kernel optimized for NAND flash and widely used as the default on Android and embedded/flash storage. F2FS reserves several synthetic 'meta' inodes for internal structures; F2FS_COMPRESS_INO() derives its number from NM_I(sbi)->max_nid and only exists when the compress_cache mount option is active. The bug is an improper-validation / type-confusion class issue (no CWE assigned in the feed; conceptually CWE-20 improper input validation over on-disk metadata): is_meta_ino() reported the compress inode as internal regardless of whether COMPRESS_CACHE was enabled, so f2fs_iget() bypassed the normal do_read_inode() path and its nid range check, fabricating an in-memory inode for a value that is otherwise an out-of-range node id. CPE data identifies the affected component only broadly as cpe:2.3:a:linux:linux, i.e. the mainline kernel's f2fs subsystem rather than a distinct product.

RemediationAI

Vendor-released patch: update to a fixed kernel - 6.1.177, 6.6.144, 6.12.95, 6.18.38, or 7.1.3 (mainline 7.2-rc1) or your distribution's backported equivalent; apply the corresponding stable commits (https://git.kernel.org/stable/c/29115b8c9172d34e67ab26cc4f6c209b7a236d7a and siblings) if building from source. Where immediate patching is not possible, the practical compensating control is to prevent mounting of untrusted f2fs images: disable or restrict automount of removable media (udisks/autofs policies), avoid mounting f2fs volumes from untrusted sources, and where feasible remove or blacklist the f2fs module (modprobe blacklist / mount option restriction) on systems that do not require it - the trade-off is loss of f2fs support for any legitimate flash media. If f2fs is required but compression is not in use, note the bug specifically manifests when compress_cache is disabled, so simply toggling the mount option is not a reliable workaround and patching remains the correct fix.

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63817 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63817

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code