CVE-2026-63818
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead. Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.
How to fix
- Linux Linux210c210c92d78fdf5051bc55c5c69044b1a2150a, ad101d15716f5a24d1fa82a849f80430c805a3dd, d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70, d2f236196d542ccd8505736e41c3a1d3f0305f6f, 550511a2470f6d204fa07b331f048bd2d3c51280, 8aad54746c251f2c2370118df766c0c82e2d2091, 2e12381d4495dc8b0ff042c6856022b2e359835c, 846c499a65816d13f1186e3090e825e8bb8bcb8b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < 210c210c92d78fdf5051bc55c5c69044b1a2150a, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < ad101d15716f5a24d1fa82a849f80430c805a3dd, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < d2f236196d542ccd8505736e41c3a1d3f0305f6f, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < 550511a2470f6d204fa07b331f048bd2d3c51280, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < 8aad54746c251f2c2370118df766c0c82e2d2091, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < 2e12381d4495dc8b0ff042c6856022b2e359835c, 127e670abfa7fa150f6550d620ded930f5bdb4e7 ≤ v < 846c499a65816d13f1186e3090e825e8bb8bcb8b, 3.8 | 210c210c92d78fdf5051bc55c5c69044b1a2150a, ad101d15716f5a24d1fa82a849f80430c805a3dd, d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70, d2f236196d542ccd8505736e41c3a1d3f0305f6f, 550511a2470f6d204fa07b331f048bd2d3c51280, 8aad54746c251f2c2370118df766c0c82e2d2091, 2e12381d4495dc8b0ff042c6856022b2e359835c, 846c499a65816d13f1186e3090e825e8bb8bcb8b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.