CVE-2026-63818

f2fs: validate orphan inode entry count

State: Published
Severity: 8.4 High
Published: Jul 19, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate orphan inode entry count

f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.

On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.

Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 210c210c92d78fdf5051bc55c5c69044b1a2150aAffected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before ad101d15716f5a24d1fa82a849f80430c805a3ddAffected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70Affected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before d2f236196d542ccd8505736e41c3a1d3f0305f6fAffected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 550511a2470f6d204fa07b331f048bd2d3c51280Affected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 8aad54746c251f2c2370118df766c0c82e2d2091Affected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 2e12381d4495dc8b0ff042c6856022b2e359835cAffected 127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 846c499a65816d13f1186e3090e825e8bb8bcb8bAffected
LinuxLinux	3.8Affected before 3.8Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.38 through 6.18.Not affected 7.1.3 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 210c210c92d78fdf5051bc55c5c69044b1a2150aAffected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before ad101d15716f5a24d1fa82a849f80430c805a3ddAffected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70Affected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before d2f236196d542ccd8505736e41c3a1d3f0305f6fAffected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 550511a2470f6d204fa07b331f048bd2d3c51280Affected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 8aad54746c251f2c2370118df766c0c82e2d2091Affected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 2e12381d4495dc8b0ff042c6856022b2e359835cAffected
127e670abfa7fa150f6550d620ded930f5bdb4e7 to before 846c499a65816d13f1186e3090e825e8bb8bcb8bAffected

LinuxLinux

3.8Affected
before 3.8Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.38 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.