Skip to main content

Linux Kernel EUVDEUVD-2026-45482

| CVE-2026-63816 HIGH
2026-07-19 Linux GHSA-gp48-qw68-qgg5
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local, low-priv trigger via ioctl; AC:H because it is a timing race; UAF corrupts memory (I:H) and reliably crashes (A:H), with no direct confidentiality disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:41 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

  • ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
  • f2fs_gc
  • gc_data_segment
  • ra_data_block(cow_inode)
  • mapping = F2FS_I(inode)->atomic_inode->i_mapping

: f2fs_is_cow_file(cow_inode) is true

  • f2fs_evict_inode(atomic_inode)
  • clear_inode_flag(fi->cow_inode, FI_COW_FILE)
  • F2FS_I(fi->cow_inode)->atomic_inode = NULL

...

  • truncate_inode_pages_final(atomic_inode)
  • f2fs_grab_cache_folio(mapping)

: create folio in atomic_inode->mapping

  • clear_inode(atomic_inode)
  • BUG_ON(atomic_inode->i_data.nrpages)

We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.

AnalysisAI

Local privilege-adjacent memory corruption in the Linux kernel's F2FS filesystem allows a low-privileged user with access to an F2FS-mounted volume to trigger a use-after-free on the atomic_inode structure. During garbage collection of an atomic (copy-on-write) file via ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE), a race with concurrent inode eviction lets the kernel dereference and populate the page mapping of an already-freed atomic_inode, corrupting kernel memory and typically causing a BUG_ON/crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and this is not on CISA KEV. A vendor fix that takes a reference on fi->atomic_inode before use has been merged upstream.

Technical ContextAI

F2FS (Flash-Friendly File System) is a mainline Linux filesystem optimized for NAND/flash storage. It supports atomic writes through a copy-on-write (COW) mechanism: a 'cow_inode' backs staged writes and references a shared atomic_inode whose i_mapping (page cache) holds the atomic data. The bug is a classic use-after-free (CWE-416): the garbage collection path (f2fs_gc -> gc_data_segment -> ra_data_block) reads F2FS_I(inode)->atomic_inode->i_mapping and grabs a cache folio in that mapping, but a concurrent f2fs_evict_inode() can clear FI_COW_FILE, set atomic_inode to NULL, and run truncate_inode_pages_final()/clear_inode() on the atomic_inode. Because GC never took a reference on fi->atomic_inode, it operates on freed memory; the subsequent folio creation adds a page to a mapping under teardown, tripping BUG_ON(atomic_inode->i_data.nrpages) in clear_inode(). The root cause is missing reference counting on a shared inode across the GC and eviction paths.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.96, 6.18.39, 7.1.3, or 7.2-rc1 (or later), which correspond to the merged fix that acquires a reference on fi->atomic_inode before dereferencing its i_mapping during GC. The relevant stable commits are 56038756aae68312df00d4aa1d97e51ef3aca725, a805fec35c201c59643ddcde713bce4051c8ee27, a499f77c06050a28c897bdbd86cd2f0721ae0743, and e0288584baa5dc41df4a829a023c4c1b33fe53d7 (https://git.kernel.org/stable/c/56038756aae68312df00d4aa1d97e51ef3aca725). Where immediate patching is not possible, compensating controls include avoiding use of the F2FS filesystem for untrusted local workloads (mount alternative filesystems for user-writable volumes), and restricting local user access to F2FS-mounted volumes since exploitation requires local access to trigger the atomic-write GC path; note these controls reduce functionality for legitimate F2FS/atomic-write users. Because triggering depends on the F2FS_IOC_GARBAGE_COLLECT_RANGE ioctl against COW files, environments that do not expose F2FS to unprivileged users are not practically exposed.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45482 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy