Skip to main content

Linux Kernel EUVDEUVD-2026-45485

| CVE-2026-63819 HIGH
2026-07-19 Linux GHSA-x28c-5hrw-xmh5
Information Disclosure Linux Debian
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft corrupted f2fs image with self-referential dnode footer
  2. Delivery
    Get image mounted on target (USB/auto-mount)
  3. Exploit
    Kernel walks inconsistent node chain during truncate
  4. Execution
    ADDRS_PER_PAGE returns inode count, offset goes out of bounds
  5. Impact
    Hit f2fs_bug_on and kernel panic (DoS)

Vulnerability Assessment

Exploitation Conditions

Exploitation requires the attacker to supply and mount a specially corrupted f2fs image - specifically one containing a direct node whose footer carries the same ino and nid as the inode, producing an inconsistent node mapping chain that is walked during f2fs_do_truncate_blocks()/inode eviction. Limiting factors: access is local only (AV:L) with no remote or network path; the attacker must be able to trigger a mount of the malicious filesystem (physical device insertion, auto-mount, or mount privileges), and the target kernel must have f2fs support enabled. There is no user-interaction requirement beyond the mount itself, and per CVSS PR:L some privilege level is expected, so this is not an unauthenticated-remote issue - it is gated on the ability to introduce and mount attacker-controlled storage.
Impact

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) reflects a local, low-complexity, low-privilege issue, but the C:H/I:H rating conflicts with the observed behavior, which is a controlled BUG_ON kernel panic - i.e., primarily an availability/DoS impact rather than confirmed confidentiality or integrity compromise. The out-of-bounds read of node addresses could in principle expose adjacent memory, but the code path terminates in a panic, so full C/I:H is not clearly supported by the description - verify with vendor before treating as info disclosure despite the 'Information Disclosure' tag. EPSS is low (0.15%, 5th percentile), the CVE is not in CISA KEV, and no POC is referenced, so this is not a widespread-exploitation priority. Real-world exploitation requires the ability to mount an attacker-supplied f2fs image, which limits reach to local/physical or auto-mount scenarios; SSVC-style reasoning puts this at 'exploitation: none, automatable: no, technical impact: partial' - a routine local-DoS hardening fix rather than an urgent remote threat. This is a defense-in-depth robustness fix typical of syzkaller-found filesystem bugs.
Exploit ScenarioDerived

An attacker crafts a malformed f2fs filesystem image in which a direct node's footer reuses the inode's own ino/nid, places it on a USB stick or supplies it as a mountable image, and gets it mounted on the target (physically or via auto-mount). During inode eviction/truncation the kernel walks the corrupted node chain, computes an out-of-bounds address offset, and hits the f2fs_bug_on(), panicking the machine. No public exploit code is currently identified; the scenario is a local, low-complexity DoS consistent with the AV:L/AC:L CVSS metrics.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local denial-of-service in the Linux kernel's f2fs filesystem lets an attacker who can mount a crafted f2fs image trigger a kernel panic (BUG_ON at fs/f2fs/file.c:845) during inode truncation. A corrupted inode containing a direct node whose footer reuses the inode's own ino/nid causes ADDRS_PER_PAGE to return an inode-sized address count (923), driving ofs_in_node into the out-of-bounds addr[923..1017] range and crashing the host. Discovered via syzkaller fuzzing; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).

RemediationAI

Vendor-released patch: upgrade to Linux 6.18.39 or 7.1.3 (or mainline 7.2-rc1 and later), or apply your distribution's backport of the fix commits from https://git.kernel.org/stable/c/406c28af75123432d38cf9bbaa6f1476f7b14770 and companions (0cc21c1ffe15..., 8712353ed80f...). Where immediate patching is not possible, the practical compensating control is to prevent mounting of untrusted f2fs images: disable or restrict automatic mounting of removable media (e.g., lock down udisks/autofs policies), require CAP_SYS_ADMIN for mount operations, and avoid mounting user-supplied filesystem images on multi-tenant hosts - the trade-off is reduced convenience for USB/removable-media workflows. If f2fs is not required on a given system, not building or blacklisting the f2fs module (modprobe blacklist f2fs) removes the attack surface entirely, at the cost of losing f2fs support. Verify fixes against your vendor's kernel advisory before deployment.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0cc21c1ffe15b4156b0bf744f32fd1faef0b7c73
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8712353ed80f87271d732297567dcdbe4b84e8c7
Linux patch: 7.1.3
Linux 0 <6.18.39
Linux patch: 6.18.39
Linux patch: 7.2-rc1
Linux 0 <7.1.3
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <406c28af75123432d38cf9bbaa6f1476f7b14770

Affected Packages

euvd linux fix: 6.18.39, 7.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

f2fs (Flash-Friendly File System) is a log-structured filesystem in the Linux kernel optimized for NAND flash, widely used on Android and embedded/flash-based devices. The bug lives in the node-mapping/truncation path: f2fs_do_truncate_blocks() calls f2fs_get_dnode_of_data() → f2fs_get_node_folio_ra() → __get_node_folio(), which historically did not verify that a fetched direct/dnode block was not actually an inode or xattr node. ADDRS_PER_PAGE() returns a different address count for inode blocks (DEF_ADDRS_PER_INODE ≈ 923) versus regular direct-node blocks (1018), so when a direct node's footer fraudulently claims the same ino/nid as the inode, the count/offset arithmetic (count = ADDRS_PER_PAGE - dn.ofs_in_node) goes negative or out of range and hits f2fs_bug_on(). The root cause class is improper validation of untrusted on-disk metadata (CWE-20 / effectively an out-of-bounds read, CWE-125), even though the NVD record lists CWE as N/A. The fix adds NODE_TYPE_NON_IXNODE and extends f2fs_sanity_check_node_footer() to reject nodes that unexpectedly appear to be inode or xattr nodes, detecting the inconsistent node chain before the bad arithmetic.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.5 MEDIUM

Local attacker must mount a crafted f2fs image (AV:L, PR:L); deterministic corrupted-metadata trigger (AC:L); impact is a kernel BUG_ON panic, so A:H with C/I:N as data disclosure is not demonstrated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on f2fs_get_node_folio_ra()

kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845 Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 <0f> 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90 RSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283 RAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000 RDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504 RBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002 R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c FS: 00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff0305c4000 CR3: 0000000012d4c000 CR4: 0000000000352ef0 Call Trace: <TASK> f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:882 f2fs_truncate+0x471/0x7c0 fs/f2fs/file.c:940 f2fs_evict_inode+0xa3f/0x1ac0 fs/f2fs/inode.c:907 evict+0x61e/0xb10 fs/inode.c:841 f2fs_fill_super+0x5f43/0x78f0 fs/f2fs/super.c:5224 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694 vfs_get_tree+0x92/0x2a0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline] do_new_mount_fc fs/namespace.c:3758 [inline] do_new_mount+0x341/0xd30 fs/namespace.c:3834 do_mount fs/namespace.c:4167 [inline] __do_sys_mount fs/namespace.c:4383 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4360 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

count = ADDRS_PER_PAGE(dn.node_folio, inode);

count -= dn.ofs_in_node; f2fs_bug_on(sbi, count < 0);

The fuzz test will trigger above bug_on in f2fs.

The root cause should be: in the corrupted inode, there is a direct node which has the same ino and nid in its footer, so in f2fs_do_truncate_blocks(), after f2fs_get_dnode_of_data() finds such dnode:

  1. ADDRS_PER_PAGE(dn.node_folio, inode) will return 923
  2. once dn.ofs_in_node points to addr[923, 1017]

Then it will trigger the system panic.

Let's introduce NODE_TYPE_NON_IXNODE to indicate current node should not be an inode or xattr node, and then use it in below path to detect inconsistent node chain in inode mapping table:

  • f2fs_do_truncate_blocks
  • f2fs_get_dnode_of_data
  • f2fs_get_node_folio_ra
  • __get_node_folio
  • f2fs_sanity_check_node_footer
  • case NODE_TYPE_NON_IXNODE -> check whether it is inode|xnode

Executive ViewAI

Why It Matters

A local denial-of-service vulnerability in the Linux kernel's f2fs filesystem (CVE-2026-63819) allows attackers with local filesystem access to trigger kernel panics and crash affected systems. The vulnerability impacts any Linux deployment using f2fs storage for data, creating availability risk that can disrupt services and operations. With a vendor patch available and demonstrated low exploitation probability, this poses manageable risk requiring prompt remediation.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
High
f2fs ships in mainline Linux; heavily used on Android and flash devices
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-63819 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/380488 REF https://git.kernel.org/stable/c/0cc21c1ffe15b4156b0bf744f32fd1faef0b7c73 REF https://git.kernel.org/stable/c/406c28af75123432d38cf9bbaa6f1476f7b14770 REF https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy