Junglewise Threat Intelligence

CVE-2026-63817: Linux Kernel F2FS invalid inode validation in is_meta_ino

CVE-2026-63817 · Severity: info · CVSS 0 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's F2FS file system component. Under certain conditions where data compression is disabled, the system could incorrectly process corrupted directory entries, leading to the creation of 'fake' internal data structures. This could potentially be used to cause system instability or bypass standard file system integrity checks.

Technical details

A vulnerability in the F2FS file system implementation in the Linux kernel arises from how is_meta_ino() handles F2FS_COMPRESS_INO(). The function F2FS_COMPRESS_INO() uses max_nid as a synthetic inode number for the compressed page cache, which should only be valid when the 'compress_cache' mount option is enabled. However, is_meta_ino() was treating this inode as a meta inode unconditionally. This allowed f2fs_iget() to bypass do_read_inode() and its associated NID range checks, resulting in the instantiation of a fake internal inode when encountering a corrupted directory entry pointing to max_nid. The fix gates the compressed cache inode validation on the COMPRESS_CACHE option.

Affected products

  • Linux Linux Kernel 5.14 to 6.1.177, 6.6.x, 6.10.x

Timeline

  • 2026-07-19: advisory: CVE-2026-63817 published by NVD
  • 2026-07-04: patched: Fix committed to Linux stable tree by Greg Kroah-Hartman

References

Related threats