CVE-2026-63811: Linux Kernel Privilege Escalation Flaw

CVE-2026-63811 Overview

CVE-2026-63811 is a Linux kernel vulnerability in the f2fs (Flash-Friendly File System) subsystem. The flaw occurs during atomic write operations when f2fs_write_begin() reads previously written data from the Copy-on-Write (COW) inode. The read path selects the fs-layer decryption context based on the COW inode instead of the original inode, causing a NULL pointer dereference in fscrypt_decrypt_pagecache_blocks() when the original inode has no i_crypt_info. Local users can trigger a kernel crash when an unencrypted file coexists with an encrypted COW inode, such as under test_dummy_encryption policies [CWE-476].

Critical Impact
A local process performing atomic writes on an unencrypted f2fs file whose COW inode inherits an encryption policy triggers a general protection fault in the post-read workqueue, resulting in kernel denial of service.

Affected Products

Linux kernel with f2fs filesystem support
Kernel builds that enable fscrypt with atomic write on f2fs
Systems using test_dummy_encryption or inherited fscrypt policies on parent directories

Discovery Timeline

2026-07-19 - CVE-2026-63811 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63811

Vulnerability Analysis

The vulnerability lives in the f2fs write path used for atomic writes. When updating an atomic-write file, f2fs_write_begin() may need to read previously written data back from the COW inode. prepare_atomic_write_begin() locates the block in the COW inode, sets the use_cow flag, and passes the COW inode into f2fs_submit_page_read(). The submitted bio then inherits its fscrypt context from the COW inode rather than the original inode.

The folio being populated belongs to the original inode (folio->mapping->host == inode). Encryption is keyed off fio->page->mapping->host in f2fs_encrypt_one_page(), and fscrypt_decrypt_pagecache_blocks() likewise operates on folio->mapping->host. The mismatch between the bio's crypto context and the folio's host inode is the root defect.

Root Cause

The COW inode is created as a tmpfile in the parent directory and inherits that directory's encryption policy. Under test_dummy_encryption, the newly created COW inode receives the dummy policy and becomes encrypted. A pre-existing regular file, created before the policy applied, remains unencrypted with a NULLi_crypt_info. f2fs_grab_read_bio() calls fscrypt_inode_uses_fs_layer_crypto() on the COW inode, sets STEP_DECRYPT, and the post-read worker later dereferences the original inode's absent crypto info.

Attack Vector

A local user with write access to an unencrypted f2fs file inside a directory that carries an fscrypt policy can trigger the fault by issuing atomic writes. The resulting general protection fault, reported by KASAN as a null-ptr-deref at fscrypt_decrypt_pagecache_blocks+0xa0/0x310, crashes the f2fs_post_read_wq workqueue and destabilizes the kernel.

The patch stops passing the COW inode into the read submission. The physical block address is already resolved by __find_data_block(cow_inode, ...) into @blkaddr, so the read uses the original inode for crypto context while still fetching the correct COW data. The now-unused use_cow flag is removed from f2fs_write_begin() and prepare_atomic_write_begin().

Detection Methods for CVE-2026-63811

Indicators of Compromise

Kernel oops entries containing general protection fault and KASAN: null-ptr-deref referencing fscrypt_decrypt_pagecache_blocks
Call traces showing f2fs_post_read_work under f2fs_post_read_wq immediately before the crash
Unexpected reboots or hung tasks on hosts running f2fs with fscrypt policies applied to directories that also contain pre-policy files

Detection Strategies

Monitor dmesg and /var/log/kern.log for oops signatures involving fscrypt_decrypt_bio and f2fs_post_read_work
Audit f2fs volumes for directories with fscrypt policies containing pre-existing unencrypted files that may still receive atomic writes
Correlate kernel panics with workloads that exercise ioctl(F2FS_IOC_START_ATOMIC_WRITE) on affected files

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on fscrypt_decrypt_pagecache_blocks in stack traces
Track kernel version inventory across Linux endpoints to identify unpatched f2fs builds
Baseline crash frequency on f2fs-backed hosts, particularly mobile and embedded systems where f2fs is common

How to Mitigate CVE-2026-63811

Immediate Actions Required

Apply the upstream f2fs patch that reads COW data using the original inode; see the kernel commit a41075acde01 and kernel commit a92332f32a8d
Update to a stable Linux kernel release that includes the fix and reboot affected hosts
Restrict local access on multi-tenant systems using f2fs with fscrypt until the patch is deployed

Patch Information

The fix modifies f2fs_write_begin() and prepare_atomic_write_begin() so the read bio is submitted with the original inode. This ensures both fs-layer decryption and inline crypto use the original inode's key. The use_cow argument is removed as it no longer has any consumer. Distribution kernels should pick up the patch from the referenced stable git commits.

Workarounds

Avoid using test_dummy_encryption on filesystems containing pre-existing unencrypted files
Do not apply fscrypt policies to directories that already contain unencrypted regular files subject to atomic writes
Disable f2fs atomic write usage in affected applications until the patched kernel is deployed

bash

# Verify running kernel and confirm patch is applied
uname -r
git log --oneline v6.x.. -- fs/f2fs/data.c | grep -i "atomic write"

# Identify f2fs mounts that may be affected
findmnt -t f2fs