Executive brief
A vulnerability in the Linux kernel's F2FS file system could allow an attacker to crash the system or read sensitive memory. By providing a specially crafted storage device or disk image, an attacker can exploit a flaw in how the system handles file attributes. This could lead to a system failure or the unauthorized viewing of data stored in the computer's memory.
Technical details
An out-of-bounds read vulnerability exists in the F2FS file system implementation within the Linux kernel. When the 'flexible_inline_xattr' feature is enabled, the 'do_read_inode()' function loads 'i_inline_xattr_size' from disk without sufficient validation in 'sanity_check_inode()' for inodes lacking the 'FI_INLINE_XATTR' flag. An attacker can provide a crafted file system image where a large 'i_inline_xattr_size' causes an integer underflow in 'MAX_INLINE_DATA()' and 'NR_INLINE_DENTRY()'. This results in 'd->max' being set to a negative value, which, when compared against an unsigned 'bit_pos' during directory walks, is promoted to a large unsigned integer, leading to out-of-bounds memory access in 'f2fs_fill_dentries()'. The issue has been patched by enforcing bounds checks on 'i_inline_xattr_size' whenever the flexible attribute feature is active.
Affected products
- Linux Linux Kernel 6afc662e68b5 to 378acf3cf19b6af6cba55e8dd1154c4e1504bae8
Timeline
- 2026-06-11: other: Vulnerability reported/fixed by Bryam Vargas
- 2026-07-19: disclosed: CVE published to NVD