EUVD-2026-80440
GHSA-6fmr-6rhp-m3p8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local low-priv user (AV:L/PR:L); AC:H because it needs a deliberately crafted source hole plus a MOVE_RANGE range that overflows validation; impact is bounded on-disk metadata corruption (I:L/A:L), no info leak (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate MOVE_RANGE destination size
F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.
Reject destination overflow and use inode_newsize_ok() before extending the destination inode.
AnalysisAI
Local low-privilege users on systems running the F2FS filesystem can trigger an integer overflow in the F2FS_IOC_MOVE_RANGE ioctl, extending a destination file's size without proper bounds checking and potentially corrupting filesystem integrity. The flaw affects Linux kernel versions from 4.8 up to the fix commits, including distributions using F2FS on Android and embedded flash storage; exploitation requires a crafted source file with a hole and the ability to issue the ioctl, and no public exploit has been identified. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a local account with the ability to open files and issue the F2FS_IOC_MOVE_RANGE ioctl on a mounted F2FS (Flash-Friendly File System) volume - so the target must be running f2fs (common on Android/embedded flash, uncommon on general-purpose Linux servers). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local, low-privilege f2fs filesystem integrity flaw, not a remotely exploitable priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by upgrading to Linux 7.2.5 or 7.3-rc1 (per EUVD) or by cherry-picking the stable commits e533889fc26aea0cd83c90327063f272061dd820 and dcae1eeda53149f219dd6af93b3083b7271c1c63 from git.kernel.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux kernel assets running the F2FS filesystem (kernel 4.8 and later), prioritizing Android fleets and embedded flash-storage devices, and identify which of them host local users or applications able to issue the F2FS_IOC_MOVE_RANGE ioctl; reduce local shell and application privileges to the minimum required and enable file-integrity monitoring on affected volumes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today