CVE-2026-63815

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the f2fs file system when the flexible inline xattr feature is enabled. The do read inode() function loads the i inline xattr size value from disk without sufficient validation for inodes that lack the FI INLINE XATTR flag. A crafted disk image can provide a large i inline xattr size value, causing MAX INLINE DATA() and NR INLINE DENTRY() to result in negative values. When make dentry ptr inline() assigns this negative value to d->max, the subsequent directory walk in f2fs fill dentries() compares an unsigned long bit pos against this value. The negative integer is promoted to a large unsigned bound, leading the system to read memory far beyond the inline area. This issue also corrupts ADDRS PER INODE for regular files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.