What is the CVSS score of CVE-2026-63818?

CVE-2026-63818 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-63818?

Within 24 hours, scan the environment for systems running F2FS filesystems and verify current kernel versions against the vendor advisory. Within 7 days, apply the vendor-released patch to non-critical F2FS systems after validation in a test environment, confirming filesystem stability and performance post-patch. Complete patch deployment across all remaining affected systems within 30 days, scheduling kernel updates during approved maintenance windows to minimize production disruption.

Linux Kernel CVE-2026-63818

Q: Which versions of Linux Kernel are affected by CVE-2026-63818?

CVE-2026-63818 is a local kernel denial-of-service vulnerability in Linux F2FS filesystems that can cause system outages when an attacker mounts a crafted filesystem image.. A patch is available.

EUVD-2026-45484 HIGH

2026-07-19 Linux

GHSA-2q7w-rghx-vwh8

Information Disclosure Linux Checkpoint

8.4

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft F2FS image with forged orphan entry_count
Delivery

Deliver via removable media or mountable image
Exploit

Victim or automount mounts volume
Execution

Orphan recovery reads past ino[] array
Impact

f2fs_bug_on() triggers kernel panic (DoS)

Vulnerability Assessment

Exploitation Conditions	Exploitation requires the attacker to supply a specially crafted F2FS filesystem image (with a forged orphan-block entry_count larger than F2FS_ORPHANS_PER_BLOCK) AND have that image mounted on the target - via physical/local access to removable media, an automount daemon, or any workflow that mounts untrusted block devices. It only triggers during checkpoint orphan-inode recovery at mount time, so it is limited to F2FS volumes and does not affect systems that never mount attacker-controlled F2FS images; there is no network vector. Limiting factors: the kernel must include the f2fs module, mount of untrusted media must be permitted, and the primary outcome is a panic (DoS) plus a bounded OOB read rather than confirmed code execution.
Impact	The CVSS 3.1 base score is 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting local attack with high impact. However, signals conflict: EPSS is only 0.16% (5th percentile), there is no KEV listing, and no public POC is referenced, indicating low real-world exploitation likelihood. The AV:L rating is consistent with the description (a crafted on-disk image must be mounted), but the PR:N/UI:N combination is optimistic - realistic exploitation requires the victim to mount attacker-supplied media, which in practice involves either physical access or an automount configuration. The confirmed technical impact is a reproducible kernel panic (availability) plus a bounded out-of-bounds read; the I:H (integrity) rating appears overstated since the flaw does not clearly enable controlled memory writes. This is a genuine local DoS worth patching on multi-user or kiosk/removable-media systems, but it is not an internet-facing or automatable mass-exploitation risk.
Exploit ScenarioDerived	An attacker crafts an F2FS image whose checkpoint orphan block declares an entry_count exceeding F2FS_ORPHANS_PER_BLOCK, then delivers it as removable media (USB stick, SD card) or a mountable image on a shared or kiosk system. When the victim or an automount service mounts the volume, orphan recovery reads past the ino[] array, interprets trailing data as inode numbers, and trips f2fs_bug_on(), panicking the kernel. No public POC is referenced, but the trigger is deterministic given the low AC.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 6.12.96, 6.18.38, 7.1.3, or mainline 7.2-rc1 or later - matching your stable series, using the corresponding git.kernel.org/stable commits (e.g. 550511a2470f, 8aad54746c25, 846c499a6581, 2e12381d4495). Where immediate patching is not possible, reduce exposure by preventing untrusted F2FS images from being mounted: disable filesystem automount of removable media (udisks/systemd automount), restrict mount capability so only trusted administrators mount block devices, and blacklist the f2fs module (via modprobe blacklist or fs.f2fs restrictions) on systems that do not require it - the trade-off is loss of automount convenience and F2FS support respectively. Run fsck on any suspect F2FS volume before mounting, since the fix relies on failing the mount with -EFSCORRUPTED and flagging fsck.

Affected VersionsENISA

Linux patch: 7.1.3

Linux 127e670abfa7fa150f6550d620ded930f5bdb4e7 <8aad54746c251f2c2370118df766c0c82e2d2091

Linux 127e670abfa7fa150f6550d620ded930f5bdb4e7 <846c499a65816d13f1186e3090e825e8bb8bcb8b

Linux 127e670abfa7fa150f6550d620ded930f5bdb4e7 <550511a2470f6d204fa07b331f048bd2d3c51280

Linux patch: 6.18.38

Linux patch: 6.12.96

Linux patch: 0

Linux 3.8

Linux 127e670abfa7fa150f6550d620ded930f5bdb4e7 <2e12381d4495dc8b0ff042c6856022b2e359835c

Linux patch: 7.2-rc1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

F2FS (Flash-Friendly File System) is a Linux log-structured filesystem widely used on Android and flash storage. During mount-time checkpoint replay, f2fs_recover_orphan_inodes() reads orphan blocks from the checkpoint pack; each block carries an entry_count and a fixed-size ino[] array bounded by F2FS_ORPHANS_PER_BLOCK. The root cause is a missing bounds check (a CWE-125 out-of-bounds read / CWE-20 improper input validation class defect, though the CVE lists CWE as N/A): the recovery loop consumes entry_count entries without validating it against the array capacity, so a forged count causes it to interpret block footer or trailing data as orphan inode numbers, reaching an internal f2fs_bug_on() assertion. Per CPE data the affected component is the Linux kernel itself (cpe:2.3:a:linux:linux:*). The fix validates entry_count before consuming entries, fails the mount with -EFSCORRUPTED, and records ERROR_INCONSISTENT_ORPHAN in the superblock s_errors[] to hint fsck.

Know when Checkpoint gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.1 MEDIUM

Requires mounting an attacker-supplied F2FS image (AV:L, UI:R for media insertion); primary impact is kernel panic (A:H) plus a bounded OOB read (C:L), with no clear integrity write (I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.4 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:02 cve.org

HIGH 8.4

CVE Published

Jul 19, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate orphan inode entry count

f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.

On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.

Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

Executive ViewAI

Why It Matters

CVE-2026-63818 is a local kernel denial-of-service vulnerability in Linux F2FS filesystems that can cause system outages when an attacker mounts a crafted filesystem image. This affects organizations operating F2FS deployments, particularly in containerized or multi-tenant environments where filesystem mount operations may be accessible to less-trusted users. A vendor patch is available, enabling timely remediation of this moderate service continuity risk.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Ubiquitous

Linux kernel; F2FS is default on many Android and flash-storage devices

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Checkpoint

View all

CVE-2014-6271 CRITICAL Act Now POC

9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH Act Now POC

8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL Act Now POC

9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH Act Now POC

7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-85102 CRITICAL Emergency POC

9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V

CVE-2026-16232 CRITICAL Emergency POC

9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL Emergency POC

9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2026-93616 CRITICAL Emergency POC

9.8 Sep 22

Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory

CVE-2021-3449 MEDIUM This Month

5.9 Mar 25

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med

CVE-2026-85103 CRITICAL Emergency POC

9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu

CVE-2026-91843 CRITICAL Act Now POC

9.8 Sep 16

Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl

CVE-2024-3568 CRITICAL Act Now POC

9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back