Skip to main content

Linux Kernel CVE-2026-63818

| EUVDEUVD-2026-45484 HIGH
2026-07-19 Linux GHSA-2q7w-rghx-vwh8
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.1 MEDIUM

Requires mounting an attacker-supplied F2FS image (AV:L, UI:R for media insertion); primary impact is kernel panic (A:H) plus a bounded OOB read (C:L), with no clear integrity write (I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:42 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.4 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 8.4
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate orphan inode entry count

f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.

On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.

Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

AnalysisAI

Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.

Technical ContextAI

F2FS (Flash-Friendly File System) is a Linux log-structured filesystem widely used on Android and flash storage. During mount-time checkpoint replay, f2fs_recover_orphan_inodes() reads orphan blocks from the checkpoint pack; each block carries an entry_count and a fixed-size ino[] array bounded by F2FS_ORPHANS_PER_BLOCK. The root cause is a missing bounds check (a CWE-125 out-of-bounds read / CWE-20 improper input validation class defect, though the CVE lists CWE as N/A): the recovery loop consumes entry_count entries without validating it against the array capacity, so a forged count causes it to interpret block footer or trailing data as orphan inode numbers, reaching an internal f2fs_bug_on() assertion. Per CPE data the affected component is the Linux kernel itself (cpe:2.3:a:linux:linux:*). The fix validates entry_count before consuming entries, fails the mount with -EFSCORRUPTED, and records ERROR_INCONSISTENT_ORPHAN in the superblock s_errors[] to hint fsck.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 6.12.96, 6.18.38, 7.1.3, or mainline 7.2-rc1 or later - matching your stable series, using the corresponding git.kernel.org/stable commits (e.g. 550511a2470f, 8aad54746c25, 846c499a6581, 2e12381d4495). Where immediate patching is not possible, reduce exposure by preventing untrusted F2FS images from being mounted: disable filesystem automount of removable media (udisks/systemd automount), restrict mount capability so only trusted administrators mount block devices, and blacklist the f2fs module (via modprobe blacklist or fs.f2fs restrictions) on systems that do not require it - the trade-off is loss of automount convenience and F2FS support respectively. Run fsck on any suspect F2FS volume before mounting, since the fix relies on failing the mount with -EFSCORRUPTED and flagging fsck.

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

CVE-2019-8461 HIGH POC
7.8 Aug 29

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo

CVE-2019-8452 HIGH POC
7.8 Apr 22

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-63818 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy