CVE-2026-63818

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the f2fs file system where the f2fs recover orphan inodes() function trusts the entry count of the orphan block when replaying orphan inodes from the checkpoint pack. If a corrupted entry count exceeds the F2FS ORPHANS PER BLOCK limit, the recovery loop reads beyond the ino[] array, interpreting footer or subsequent data as inode numbers. When mounting a specially crafted image, this can trigger the f2fs bug on() function and cause a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.