{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-63815 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-63815 is a high-severity memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-63815 and fix it if it is affected.\n\nWhat it is: CVE-2026-63815 is a high-severity memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-63815 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-63815/ (Markdown: https://insights.sbomify.com/CVE-2026-63815/index.md)","id":"CVE-2026-63815","markdown":"https://insights.sbomify.com/CVE-2026-63815/index.md","name":"CVE-2026-63815","record":{"aliases":["BELL-CVE-2026-63815","DEBIAN-CVE-2026-63815","GHSA-7mq9-8547-cp53","ROOT-OS-DEBIAN-11-CVE-2026-63815","ROOT-OS-DEBIAN-12-CVE-2026-63815","ROOT-OS-UBUNTU-2204-CVE-2026-63815","UBUNTU-CVE-2026-63815"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel f2fs","requires_auth":"none","summary":"An attacker with a crafted filesystem image can trigger an out-of-bounds read in the Linux kernel f2fs driver, potentially leaking memory or causing a crash.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.4,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size = le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set.  An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA()  = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page()   = CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue.  The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size == 0 are still accepted.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"f2fs: bound i_inline_xattr_size for non-inline-xattr inodes","id":"CVE-2026-63815","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode","id":"CVE-2026-63816"},"packages":[],"prev":{"headline":"f2fs: validate ACL entry sizes in f2fs_acl_from_disk()","id":"CVE-2026-63814"},"products":["Linux"],"published":"2026-07-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"An attacker with a crafted filesystem image can trigger an out-of-bounds read in the Linux kernel f2fs driver, potentially leaking memory or causing a crash.","url":"https://insights.sbomify.com/CVE-2026-63815/"}