PT-2026-61135 · Linux · Linux Kernel

CVE-2026-63819 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the F2FS file system where a missing sanity check in the f2fs get node folio ra() function can lead to a system panic. In cases involving a corrupted inode, a direct node may contain the same inode number (ino) and node ID (nid) in its footer. When f2fs do truncate blocks() calls f2fs get dnode of data(), it can result in an inconsistent node chain in the inode mapping table, causing the f2fs bug on() function to trigger a kernel BUG and subsequent system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63819

Affected Products

Linux Kernel

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-63819 · Security Note
• https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7 · Note
• https://git.kernel.org/stable/c/406c28af75123432d38cf9bbaa6f1476f7b14770 · Note
• https://git.kernel.org/stable/c/0cc21c1ffe15b4156b0bf744f32fd1faef0b7c73 · Note
• https://twitter.com/VulmonFeeds/status/2078876663505367538 · Twitter Post