PT-2026-61133 · Linux · Linux Kernel

CVE-2026-63817 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the f2fs file system where the is meta ino() function unconditionally treats the F2FS COMPRESS INO() as a meta inode. When the compress cache mount option is disabled, the max nid value used for the compressed page cache inode falls outside the valid inode range. Consequently, a corrupted directory entry pointing to ino == max nid bypasses the do read inode() function and its associated f2fs check nid range() check, leading to the instantiation of a fake internal inode instead of being rejected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63817

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-63817 · Security Note
• https://git.kernel.org/stable/c/77f216ff9ce5cde8eed9f6d12707e906dffdc9f7 · Note
• https://twitter.com/VulmonFeeds/status/2078886908327792884 · Twitter Post
• https://git.kernel.org/stable/c/0969926d987bbde9a1aa49da317582ba37095805 · Note
• https://git.kernel.org/stable/c/5073c66a96a9c23c0c2533ed4ed06e42f9021208 · Note
• https://git.kernel.org/stable/c/13e4b59d3a9413f66f116fa6c4828519b960a5ea · Note
• https://git.kernel.org/stable/c/29115b8c9172d34e67ab26cc4f6c209b7a236d7a · Note
• https://git.kernel.org/stable/c/16161444c30d8dff9428abbae42b72ce4e32a932 · Note