CVE-2026-63820: Linux Kernel f2fs DOS Vulnerability

CVE-2026-63820 Overview

CVE-2026-63820 is a Linux kernel vulnerability in the Flash-Friendly File System (f2fs) subsystem. The flaw resides in f2fs_read_data_large_folio(), which can retain a read block I/O (bio) structure across multiple readahead folios. When a later folio encounters an error before any of its blocks are added to the bio, the accumulated bio for earlier folios remains unsubmitted. This condition prevents earlier folios from receiving read completion, causing readers to wait indefinitely on locked folios.

Critical Impact
Processes performing readahead against f2fs volumes can hang indefinitely on locked folios, leading to denial-of-service conditions on affected Linux systems.

Affected Products

Linux kernel with f2fs support enabled
Kernel versions containing the vulnerable f2fs_read_data_large_folio() implementation
Distributions shipping the affected upstream kernel commits

Discovery Timeline

2026-07-19 - CVE-2026-63820 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63820

Vulnerability Analysis

The vulnerability affects the f2fs readahead path in the Linux kernel. The function f2fs_read_data_large_folio() is designed to accumulate a single bio across multiple folios during large folio readahead operations. This batching improves I/O efficiency but introduces state that must be handled correctly along all error paths.

When an error occurs on a later folio in the readahead sequence, the existing error handler checks a flag named folio_in_bio. If that flag is false — meaning no blocks from the current folio were attached to the accumulated bio — the code ends the folio and returns immediately. The bio containing blocks from earlier folios is never submitted to the block layer.

The earlier folios remain locked while awaiting a read completion that will never arrive. Any process reading those pages blocks indefinitely. The condition can propagate to unrelated tasks that touch the same file offsets, expanding the impact beyond the original reader.

Root Cause

The root cause is an incomplete error path in the large folio readahead handler. The function fails to route errors through the common cleanup path that submits any pending bio. Instead, an early return abandons the accumulated bio without calling submission logic. This is a control-flow defect [CWE-670] that leaves shared kernel state inconsistent.

Attack Vector

Triggering the condition requires read I/O against an f2fs-formatted volume where a readahead operation encounters an error on a non-first folio in a multi-folio batch. Sources of such errors include underlying block device faults, corrupted metadata, or induced I/O failures. An attacker with the ability to influence storage errors on shared f2fs systems could produce hangs affecting other users of the volume.

The upstream fix routes errors through the common out path so any pending bio is submitted before returning. It also stops consuming additional readahead folios once an error is observed, and only waits on and clears the current folio when that folio was actually added to the bio.

Detection Methods for CVE-2026-63820

Indicators of Compromise

Processes in D (uninterruptible sleep) state blocking on f2fs folio locks
Kernel stack traces showing threads waiting in folio_wait_bit_common or filemap_read against f2fs inodes
Growing number of tasks hung on read operations against the same f2fs mount
Block device error messages preceding readahead hangs in dmesg

Detection Strategies

Monitor hung_task warnings emitted by the kernel when tasks exceed the configured stall threshold
Correlate f2fs block layer errors with subsequent read-path hangs on the same filesystem
Track kernel version and patch state across the fleet to identify hosts running vulnerable f2fs code

Monitoring Recommendations

Enable CONFIG_DETECT_HUNG_TASK and forward kernel log events to a centralized log store
Alert on repeated INFO: task ... blocked for more than N seconds messages referencing f2fs functions
Track I/O error rates on f2fs-backed storage and investigate spikes that coincide with process hangs

How to Mitigate CVE-2026-63820

Immediate Actions Required

Apply the upstream f2fs fix from the referenced kernel commits to affected hosts
Prioritize patching systems that mount f2fs volumes for user-facing workloads or on removable media
Reboot into the patched kernel to activate the corrected readahead error path

Patch Information

The fix is available in the mainline and stable trees. Relevant references include the Kernel Git Commit 48c9255 and the Kernel Git Commit 74c8d2e. The patch routes errors through the common out path, halts further readahead consumption after an error, and conditionally waits on the current folio only when it was added to the bio.

Workarounds

Avoid using f2fs on affected kernels for workloads where storage errors are likely
Reduce readahead sizes on f2fs mounts to lower the probability of multi-folio bio accumulation
Address underlying block device errors promptly, since the hang condition requires a readahead error to trigger

bash

# Verify running kernel version and check for f2fs mounts
uname -r
mount | grep f2fs

# Reduce readahead on an f2fs-backed block device (temporary mitigation)
blockdev --setra 256 /dev/<device>