CVE-2026-63817

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the f2fs file system where the is meta ino() function unconditionally treats F2FS COMPRESS INO() as a meta inode. This occurs even when the compress cache mount option is disabled, a state in which the max nid used as the synthetic inode number is outside the valid inode range. Consequently, f2fs iget() bypasses the do read inode() function and its associated f2fs check nid range() check, allowing the instantiation of a fake internal inode when encountering a corrupted directory entry pointing to ino == max nid.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.