PT-2026-61129 · Linux · Linux Kernel

CVE-2026-63813 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A race condition exists in the F2fs file system of the Linux kernel, which can lead to list corruption and subsequent kernel panics, particularly when the F2fs partition is nearly full. The issue occurs during the garbage collection process in the move data block() function. Specifically, a race between split folio to order(), folio isolate lru(), and the final folio put() release path can result in a page being freed back to the allocator while its links remain in the Least Recently Used (LRU) list. When a subsequent LRU operation encounters these stale links, it triggers a kernel BUG and system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63813

Affected Products

Linux Kernel

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-63813 · Security Note
• https://git.kernel.org/stable/c/6e035dae44154af4dd7bdb8ef7a1118c0b5f17b6 · Note
• https://git.kernel.org/stable/c/1991d49433e90b2202de2fe90be3c24161873d7c · Note
• https://git.kernel.org/stable/c/ccaba785821970f422c47770331c7e3271763f17 · Note
• https://twitter.com/VulmonFeeds/status/2078881785899839578 · Twitter Post