CVE-2026-63815: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63815 Overview

CVE-2026-63815 is an out-of-bounds read vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) driver. The flaw resides in the handling of i_inline_xattr_size when the flexible_inline_xattr feature is enabled. The kernel loads the on-disk value unconditionally in do_read_inode(), but sanity_check_inode() only range-checks the field when the inode carries the FI_INLINE_XATTR flag. A crafted filesystem image can supply an attacker-controlled i_inline_xattr_size on inodes with inline dentries or inline data, corrupting inode geometry and triggering out-of-bounds reads during directory traversal.

Critical Impact
Mounting a crafted f2fs image and reading an inline directory triggers an out-of-bounds read in f2fs_fill_dentries() and corrupts ADDRS_PER_INODE for regular files, enabling local denial of service and potential information disclosure from kernel memory.

Affected Products

Linux kernel builds with f2fs support and the flexible_inline_xattr feature enabled
Stable kernel branches referenced by the fix commits listed in the NVD entry
Distributions shipping unpatched f2fs modules that permit mounting untrusted images

Discovery Timeline

2026-07-19 - CVE-2026-63815 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-63815

Vulnerability Analysis

The vulnerability is an Out-of-Bounds Read [CWE-125] caused by insufficient input validation of an on-disk metadata field. When flexible_inline_xattr is active, do_read_inode() reads i_inline_xattr_size from the raw inode without gating. The existing sanity check applies only to inodes marked with FI_INLINE_XATTR, so an inode carrying an inline dentry or inline data but not that flag retains an attacker-controlled value.

get_inline_xattr_addrs() propagates the tainted value into the inode geometry calculations. The macros MAX_INLINE_DATA(), NR_INLINE_DENTRY(), and addrs_per_page() all subtract i_inline_xattr_size from CUR_ADDRS_PER_INODE. A large value drives these results negative, and make_dentry_ptr_inline() stores the result in a signed intd->max.

During directory iteration, f2fs_fill_dentries() compares an unsigned bit_pos against d->max. The negative signed value is promoted to a large unsigned bound, and the loop reads far beyond the inline area via test_bit_le() and d->dentry[bit_pos].

Root Cause

The root cause is a missing bound check. Validation of i_inline_xattr_size was gated on the FI_INLINE_XATTR flag rather than on whether the value is actually loaded and consumed. The fix validates i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever flexible_inline_xattr is enabled, while keeping the MIN_INLINE_XATTR_SIZE lower bound gated on inodes that carry an inline xattr so legitimate inodes with i_inline_xattr_size == 0 remain valid.

Attack Vector

An attacker with the ability to supply a crafted f2fs image and induce a mount plus directory read triggers the flaw. This is typically local, but is also relevant in scenarios involving removable media, container images, or automated mounting of untrusted volumes. No network access or authentication is required beyond the ability to present the malicious image to the kernel.

See the upstream patch commits (16bc237c, 2a9f9791, 378acf3c, 3c8d6b40, 4ce2d52f, 76e1a05c, a08ee30d, c3e05522) for the exact validation added in sanity_check_inode().

Detection Methods for CVE-2026-63815

Indicators of Compromise

Kernel oops, warning, or KASAN out-of-bounds read reports originating in f2fs_fill_dentries() or inline dentry walk code paths.
Unexpected mount events for f2fs volumes originating from removable media, loopback devices, or user-provided images.
System logs showing repeated crashes or panics tied to reading directories on a newly attached f2fs volume.

Detection Strategies

Monitor dmesg and journalctl -k for f2fs-tagged errors, BUG:, KASAN, or slab-out-of-bounds messages after mount or readdir operations.
Audit mount syscalls with auditd or eBPF probes to identify f2fs mounts of untrusted block devices or loop-mounted image files.
Correlate directory enumeration by unprivileged processes with recent f2fs mount activity in EDR telemetry.

Monitoring Recommendations

Enable KASAN in test environments to surface out-of-bounds accesses in f2fs code paths before deployment.
Alert on kernel version and running module state to identify hosts still exposing unpatched f2fs drivers.
Track privileged operations such as mount, losetup, and udev-triggered auto-mount events on production Linux endpoints.

How to Mitigate CVE-2026-63815

Immediate Actions Required

Apply the upstream f2fs patch series that bounds i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever flexible_inline_xattr is enabled.
Update to the stable kernel release from your distribution that incorporates the referenced commits.
Restrict the ability of non-root users to mount arbitrary block devices or loopback images.

Patch Information

The fix is distributed across multiple stable-tree commits. Reference the upstream patches: 16bc237c, 2a9f9791, 378acf3c, 3c8d6b40, 4ce2d52f, 76e1a05c, a08ee30d, and c3e05522. Coordinate with your distribution vendor to confirm which backports apply to your kernel.

Workarounds

Disable automatic mounting of removable media in udev and desktop environments where f2fs images may be presented.
Blacklist the f2fs kernel module on systems that do not require it using /etc/modprobe.d/ configuration.
Restrict CAP_SYS_ADMIN and reject user-namespace-driven mounts of f2fs on untrusted images until patches are deployed.

bash

# Configuration example: prevent f2fs module autoload on hosts that don't need it
echo 'blacklist f2fs' | sudo tee /etc/modprobe.d/disable-f2fs.conf
echo 'install f2fs /bin/true' | sudo tee -a /etc/modprobe.d/disable-f2fs.conf
sudo update-initramfs -u