CVE-2026-63818 f2fs: validate orphan inode entry count
A crafted filesystem image can cause a kernel panic during orphan inode recovery, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63818?
CVE-2026-63818 is a high-severity denial of service vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate orphan inode entry count
f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.
Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.
Which versions are affected by CVE-2026-63818?
How do I fix CVE-2026-63818?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63818 being exploited?
There is no known exploitation of CVE-2026-63818 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63818, DEBIAN-CVE-2026-63818, GHSA-2q7w-rghx-vwh8, ROOT-OS-DEBIAN-11-CVE-2026-63818, ROOT-OS-DEBIAN-12-CVE-2026-63818, ROOT-OS-UBUNTU-2204-CVE-2026-63818 and 1 more.