EUVD-2026-80438
GHSA-jfgp-78p5-g7hq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local-only; AC:H because it needs a crafted f2fs image plus roll-forward recovery trigger; PR:L for mount of attacker media; C:L for a small bounded adjacent-inode leak to the log; no integrity or crash impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
f2fs: limit recovery filename logging to stored length
F2FS stores recovery filenames as a length plus a fixed-size i_name buffer. The buffer is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s.
For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.
Print the name with a precision bounded by i_namelen and F2FS_NAME_LEN.
AnalysisAI
F2FS recovery logging in the Linux kernel can read past the fixed-size, non-NUL-terminated i_name buffer and expose adjacent raw inode fields into kernel logs when a crafted or corrupted f2fs filesystem is mounted. The flaw has been present since Linux 3.11 and is reachable only via the roll-forward recovery path that processes fsync'd dentries left pending after an unclean shutdown, requiring a filename that fills the full F2FS_NAME_LEN (255 bytes); our independent assessment rates this LOW real-world risk (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) because it needs local mount capability (CAP_SYS_ADMIN or equivalent) and the leaked bytes are confined to raw inode fields in the same block buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the f2fs roll-forward recovery path to execute - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a LOW real-world risk issue despite the vendor CVSS of 7.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released fix: update to a kernel containing upstream commits 01027b2fcb74dade59fb833b51023f6593b6a9a2 or 317d32e1a8deaf1c01c388badc667334c39e62ca (https://git.kernel.org/stable/c/317d32e1a8deaf1c01c388badc667334c39e62ca), which is reflected in Linux 7.2.5 and 7.3-rc1 per the EUVD version mapping; distribution users should track their vendor's kernel errata rather than the upstream tag, since the inputs name no distro-specific version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running kernel versions from 3.11 up to before 7.2.5 with F2FS enabled, and verify which accounts have CAP_SYS_ADMIN or equivalent mount privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today