CVE-2026-63814

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A buffer over-read exists in the f2fs implementation of the Linux kernel. The f2fs acl count() function only validates the aggregate ACL xattr length, allowing a malformed ACL to place ACL USER or ACL GROUP in a slot containing only struct f2fs acl entry short bytes. Consequently, the f2fs acl from disk() function reads the e id variable before verifying if a full entry fits, leading to a KASAN slab-out-of-bounds read in the f2fs get acl() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.