Executive brief
A vulnerability was discovered in the Linux kernel's F2FS file system, which is commonly used on flash-based storage devices like smartphones. A specifically crafted file could cause the system to crash or behave unpredictably when processing security permissions (ACLs). This could lead to a denial-of-service, impacting the stability and availability of the affected device.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the F2FS file system component of the Linux kernel. The function f2fs_acl_count() only validates the aggregate length of ACL extended attributes (xattrs) but fails to verify individual entry sizes. A malformed ACL can place ACL_USER or ACL_GROUP tags in a space only large enough for a short entry, causing f2fs_acl_from_disk() to read the e_id field beyond the allocated buffer. This was identified via KASAN as a slab-out-of-bounds read in __f2fs_get_acl. The issue is resolved by enforcing size checks for both short and full entries before reading their respective fields, returning -EFSCORRUPTED upon failure.
Affected products
- Linux Linux kernel af48b85b8cd3 to 733cd8474e6d763d75ed96f3f2b98a25480cf2b9
Timeline
- 2026-06-15: other: Patch authored
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/1ddf3fd21c4c652f9cab5552515c04a166662306
- https://git.kernel.org/stable/c/442ca20c54038e2400cf28aaa944cf1de2c8e65d
- https://git.kernel.org/stable/c/4e2a96ec7236e248e706850568e0a925fd21b588
- https://git.kernel.org/stable/c/5d8a39649947a4e86c8fbc682d7fc0041b8d109a
- https://git.kernel.org/stable/c/733cd8474e6d763d75ed96f3f2b98a25480cf2b9
- https://git.kernel.org/stable/c/aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1
- https://git.kernel.org/stable/c/c4810ada31e80cbe4011467c4f3b1e93f94134f3