CVE-2026-63814: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63814 Overview

CVE-2026-63814 is an out-of-bounds read vulnerability in the Linux kernel's F2Fs (Flash-Friendly File System) implementation. The flaw resides in f2fs_acl_from_disk() within fs/f2fs/acl.c, where f2fs_acl_count() only validates the aggregate ACL xattr length rather than the size of individual entries. A malformed Access Control List (ACL) can place an ACL_USER or ACL_GROUP tag in a slot that only contains struct f2fs_acl_entry_short bytes. The function then reads entry->e_id before verifying that a full entry fits in memory, causing a slab out-of-bounds read detected by KASAN.

Critical Impact
A local, low-privileged attacker mounting or accessing a crafted F2Fs image can trigger a kernel out-of-bounds read leading to information disclosure, denial of service, or potential privilege escalation.

Affected Products

Linux kernel versions containing the vulnerable f2fs_acl_from_disk() implementation prior to the fixes referenced in the upstream stable commits
Distributions and devices using F2Fs as a mountable filesystem (commonly Android and embedded Linux)
Kernel builds without the ACL entry size validation patches applied

Discovery Timeline

2026-07-19 - CVE-2026-63814 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63814

Vulnerability Analysis

The vulnerability is a kernel out-of-bounds read in the F2Fs POSIX ACL parser. When userspace requests an extended attribute via getxattr(), the kernel calls __f2fs_get_acl(), which in turn invokes f2fs_acl_from_disk() to convert on-disk ACL bytes into an in-memory representation. The parser assumes every entry tagged as ACL_USER or ACL_GROUP occupies a full f2fs_acl_entry structure containing an e_id field. However, the pre-patch validation only checks the total xattr size, not the byte size of each individual entry.

An attacker crafts an ACL where the final entry is truncated to a f2fs_acl_entry_short (which omits e_id) but carries a tag of ACL_USER or ACL_GROUP. The parser reads four bytes past the end of the allocation, producing the KASAN report slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0 against an 8-byte kmalloc-8 object.

Root Cause

The root cause is insufficient input validation of untrusted filesystem metadata. f2fs_acl_count() validates only aggregate length, not per-entry length. The parser dereferences entry->e_id before confirming a full struct f2fs_acl_entry fits within the remaining xattr buffer. This is a classic out-of-bounds read pattern where a length check precedes structural validation.

Attack Vector

Exploitation requires local access with the ability to mount or supply an F2Fs filesystem image, or to write crafted ACL xattrs to an existing F2Fs mount. Typical attack scenarios include a malicious USB device presenting an F2Fs volume, a compromised container writing xattrs on shared F2Fs storage, or an unprivileged process leveraging automount behavior. Triggering the read requires only a getxattr() syscall against a file carrying the malformed ACL. The upstream fix requires a short entry before reading e_tag and e_perm, and a full entry before reading e_id for ACL_USER and ACL_GROUP, returning -EFSCORRUPTED on truncated entries.

Detection Methods for CVE-2026-63814

Indicators of Compromise

Kernel log entries containing KASAN: slab-out-of-bounds in __f2fs_get_acl on debug builds
Unexpected -EFSCORRUPTED (-EUCLEAN) return codes from getxattr() calls on F2Fs mounts after patching
Mount events for F2Fs volumes originating from removable media or user-controlled images
Processes issuing getxattr syscalls with system.posix_acl_access or system.posix_acl_default names on suspicious files

Detection Strategies

Monitor dmesg and /var/log/kern.log for F2Fs corruption warnings and KASAN reports referencing f2fs/acl.c
Audit filesystem mount events (mount, automount, udev rules) for F2Fs volumes on production hosts that should not accept them
Use auditd rules to log mount and getxattr syscalls targeting F2Fs paths
Compare kernel versions against the fixed commits (1ddf3fd, 442ca20, 4e2a96e, 5d8a396, 733cd84, aba4f94, c4810ad, ff83de56)

Monitoring Recommendations

Alert on any user-mountable F2Fs devices attached to servers or workstations that do not require F2Fs support
Track kernel oops and KASAN messages centrally through syslog forwarding to a data lake or SIEM
Correlate getxattr failures returning EFSCORRUPTED with the user and process context for triage

How to Mitigate CVE-2026-63814

Immediate Actions Required

Apply the upstream Linux kernel stable updates that include the F2Fs ACL entry size validation patches
Blacklist the f2fs kernel module on systems that do not require F2Fs support using modprobe.d configuration
Restrict unprivileged mounting of removable media and disable automount for untrusted devices
Verify container and sandbox configurations to prevent unprivileged users from mounting arbitrary filesystems

Patch Information

The fix is available across multiple stable branches through the following commits: Linux Kernel Commit 1ddf3fd, Linux Kernel Commit 442ca20, Linux Kernel Commit 4e2a96e, Linux Kernel Commit 5d8a396, Linux Kernel Commit 733cd84, Linux Kernel Commit aba4f94, Linux Kernel Commit c4810ad, and Linux Kernel Commit ff83de56. The patch enforces per-entry size checks and returns -EFSCORRUPTED on truncated entries.

Workarounds

Disable the f2fs module where not required: add blacklist f2fs to /etc/modprobe.d/blacklist-f2fs.conf
Enforce noexec, nosuid, and nodev on any required F2Fs mounts and restrict them to trusted administrators
Use udev rules to prevent automount of removable F2Fs volumes for non-root users

bash

# Configuration example: blacklist the f2fs module on systems that do not need it
echo "blacklist f2fs" | sudo tee /etc/modprobe.d/blacklist-f2fs.conf
echo "install f2fs /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-f2fs.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep f2fs