CVE-2026-63816
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_inode->i_mapping : f2fs_is_cow_file(cow_inode) is true - f2fs_evict_inode(atomic_inode) - clear_inode_flag(fi->cow_inode, FI_COW_FILE) - F2FS_I(fi->cow_inode)->atomic_inode = NULL ... - truncate_inode_pages_final(atomic_inode) - f2fs_grab_cache_folio(mapping) : create folio in atomic_inode->mapping - clear_inode(atomic_inode) - BUG_ON(atomic_inode->i_data.nrpages) We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.
How to fix
- Linux Linux7d3ae21783e5914c1761ac7d63f882d3d70800e9, 56038756aae68312df00d4aa1d97e51ef3aca725, a499f77c06050a28c897bdbd86cd2f0721ae0743, a805fec35c201c59643ddcde713bce4051c8ee27, e0288584baa5dc41df4a829a023c4c1b33fe53d7, 5.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3db1de0e582c358dd013f3703cd55b5fe4076436 ≤ v < 7d3ae21783e5914c1761ac7d63f882d3d70800e9, 3db1de0e582c358dd013f3703cd55b5fe4076436 ≤ v < 56038756aae68312df00d4aa1d97e51ef3aca725, 3db1de0e582c358dd013f3703cd55b5fe4076436 ≤ v < a499f77c06050a28c897bdbd86cd2f0721ae0743, 3db1de0e582c358dd013f3703cd55b5fe4076436 ≤ v < a805fec35c201c59643ddcde713bce4051c8ee27, 3db1de0e582c358dd013f3703cd55b5fe4076436 ≤ v < e0288584baa5dc41df4a829a023c4c1b33fe53d7, 6db52f1944417c2601182a591a704e2f119c5215, 5.18.18 ≤ v < 5.19, 5.19 | 7d3ae21783e5914c1761ac7d63f882d3d70800e9, 56038756aae68312df00d4aa1d97e51ef3aca725, a499f77c06050a28c897bdbd86cd2f0721ae0743, a805fec35c201c59643ddcde713bce4051c8ee27, e0288584baa5dc41df4a829a023c4c1b33fe53d7, 5.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.