Linux Kernel EUVD-2026-86204

Requires the attacker to supply a maliciously corrupted f2fs filesystem image AND for that image to be mounted and have its inline directories accessed, triggering inline-to-regular dentry conversion (UI:R). Exploitation is LIMITED to local vectors (AV:L): the victim must mount the crafted image (e.g., via USB auto-mount/udisks or an attacker-supplied image in a container/VM), and only f2fs filesystems using inline dentries are affected. It cannot be triggered remotely or against a running trusted filesystem without introducing the malicious image.

This is a filesystem-image-parsing bug (f2fs inline dentry conversion reads past inline filename storage when name lengths aren't validated before copy). The NVD/Linux CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H = 7.1 signals local-only, user-interaction-gated exploitation, which is consistent with the description (requires accessing/mounting a corrupted f2fs image). There is NO EPSS score, NO CISA KEV listing, and NO public POC provided - so no signal of real-world exploitation. SSVC-style: exploitation is 'none' observed, not automatable (requires a victim to mount a crafted image), technical impact partial. The C:H rating appears OVERSTATED: an OOB read while building a dentry block most plausibly yields a crash (A:H) or at most a small leak of adjacent kernel memory into the dentry structure, not reliable high-value disclosure - I assess C:L. Net: a genuine memory-safety hardening fix but a LOW real-world priority - no exploitation signal, local access plus user interaction required, and the attack primitive (feeding a corrupted image) is a classic low-yield filesystem fuzzing class. Conflict to verify: the 'Information Disclosure' tag and C:H rating vs. a description that reads as an OOB read that is crash-dominant.

An attacker crafts a corrupted f2fs filesystem image with inline dentry name-length fields that exceed the inline filename area, then gets a victim to mount/access it (e.g., a malicious USB stick auto-mounted, or a container/VM image). During inline-to-regular dentry conversion the kernel copies names before validating their lengths, reading past the inline storage and corrupting or leaking adjacent kernel memory, typically crashing the kernel. No public POC is identified at time of analysis.