CVE-2026-63820 f2fs: fix missing read bio submission on large folio error
A flaw in the Linux kernel f2fs filesystem can cause indefinite hangs during read operations, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63820?
CVE-2026-63820 is a denial of service vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix missing read bio submission on large folio error
f2fs_read_data_large_folio() can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folio_in_bio is false and the current error path returns immediately after ending that folio.
This can leave the bio accumulated for earlier folios unsubmitted. Those folios then never receive read completion, and readers can wait indefinitely on the locked folios.
Route errors through the common out path so any pending bio is submitted before returning. Stop consuming more readahead folios once an error is seen, and only wait on and clear the current folio when it was actually added to the bio.
Which versions are affected by CVE-2026-63820?
How do I fix CVE-2026-63820?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63820 being exploited?
There is no known exploitation of CVE-2026-63820 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-63820, GHSA-m33g-hj44-mvvf, UBUNTU-CVE-2026-63820.