CVE-2026-63813: Linux Kernel Race Condition Vulnerability

CVE-2026-63813 Overview

CVE-2026-63813 is a race condition vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) subsystem. The flaw is resolved by reverting commit 9609dd704725a40cd63d915f2ab6c44248a44598, which introduced logic to remove non-uptodate folios from the page cache in move_data_block(). Under garbage collection pressure on nearly full f2fs partitions, the change enabled a three-way race between the GC path, folio splitting, and LRU isolation. The race leads to a page being freed to the buddy allocator while its LRU links remain intact, causing subsequent list corruption and a kernel panic. Local attackers with the ability to trigger f2fs garbage collection can leverage this behavior to crash the system or attempt further exploitation.

Critical Impact
Local attackers can trigger LRU list corruption in the Linux kernel through f2fs garbage collection, resulting in kernel panics and potential memory corruption.

Affected Products

Linux kernel versions containing commit 9609dd704725a40cd63d915f2ab6c44248a44598
Systems using the f2fs (Flash-Friendly File System) filesystem
Distributions shipping affected stable kernels prior to the revert

Discovery Timeline

2026-07-19 - CVE-2026-63813 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63813

Vulnerability Analysis

The vulnerability resides in the f2fs move_data_block() function, which is invoked during garbage collection (GC). The reverted commit allowed the GC path to evict tail-end folios from the page cache via folio_end_dropbehind(). Once folio_unmap_invalidate() removes the folio from mapping->i_pages, the page cache references for all subpages are dropped. The folio remains alive only via transient external references. This creates a window where split_folio_to_order() can operate on a folio whose subpages lack page cache protection.

Root Cause

The root cause is a three-way race between garbage collection, large folio splitting, and LRU isolation. After split, a tail page can remain on the LRU with PG_lru set while holding only a temporary reference from the split caller. When free_folio_and_swap_cache() drops that final reference, __folio_put() enters the release path. Concurrently, folio_isolate_lru() may observe the same page with a nonzero refcount and clear PG_lru before acquiring its own reference. If the release path sees PG_lru already cleared, it skips lruvec_del_folio(), and the page is freed back to the allocator with stale LRU list links still attached.

Attack Vector

Exploitation requires local access and the ability to trigger f2fs garbage collection, typically by filling the partition or invoking fallocate() operations. The observed crash path traverses __arm64_sys_fallocate → vfs_fallocate → f2fs_fallocate → f2fs_gc → do_garbage_collect → folio_put → __folio_put → __list_del_entry_valid_or_report, terminating in a kernel BUG at lib/list_debug.c:67. The impact is denial of service through kernel panic, with potential for further memory corruption due to the freed-but-linked page.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in the kernel commit messages referenced below.

Detection Methods for CVE-2026-63813

Indicators of Compromise

Kernel panic messages referencing list_del corruption with next/prev pointer mismatches
BUG triggered at lib/list_debug.c:67 in __list_del_entry_valid_or_report
Crash traces including __folio_put, do_garbage_collect, and f2fs_gc on the call stack
Panics correlated with f2fs partitions reaching near-full capacity

Detection Strategies

Monitor kernel ring buffer (dmesg) and /var/log/kern.log for list corruption and folio_put stack traces
Track kernel version and confirm whether the affected commit 9609dd7047 is present in the running tree
Correlate crash telemetry with f2fs mount points and free-space utilization

Monitoring Recommendations

Configure kdump to capture full vmcore images for post-crash analysis of LRU list state
Alert on unexpected system reboots on devices using f2fs, particularly Android and embedded platforms
Track f2fs partition utilization and flag sustained high fill ratios that increase GC frequency

How to Mitigate CVE-2026-63813

Immediate Actions Required

Apply the upstream kernel patches that revert commit 9609dd704725a40cd63d915f2ab6c44248a44598
Identify all systems running f2fs and inventory their kernel versions against the fix commits
Prioritize patching on mobile, embedded, and Android systems where f2fs is common

Patch Information

The fix reverts the offending commit and is available in the mainline and stable trees via the following commits: Kernel Git Commit 1991d49, Kernel Git Commit 6e035da, and Kernel Git Commit ccabaa7. Rebuild and deploy kernels containing these commits, then reboot affected hosts.

Workarounds

Avoid running f2fs partitions at near-full capacity to reduce garbage collection pressure and race likelihood
Where feasible, migrate workloads off f2fs to a filesystem not affected by this regression until patched kernels are deployed
Restrict local user access and fallocate() privileges on shared systems to reduce the attack surface

bash

# Verify running kernel and check for the affected commit in source tree
uname -r
git -C /path/to/linux log --oneline | grep -E '9609dd7047|1991d4943|6e035dae44|ccaba78582'

# Identify mounted f2fs filesystems and their utilization
mount -t f2fs
df -hT -t f2fs