CVE-2026-63815 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally:
if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image.
get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry:
MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...) addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area:
while (bit_pos < d->max) /* fs/f2fs/dir.c */ ... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files.
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the f2fs filesystem implementation in the Linux kernel where improper validation of the i_inline_xattr_size field leads to out-of-bounds memory access and potential code execution. This issue specifically manifests when the flexible_inline_xattr feature is enabled, creating a scenario where attacker-controlled data can influence critical inode parameters without proper sanitization.
The technical flaw occurs during the do_read_inode() function execution where i_inline_xattr_size is unconditionally loaded from on-disk structures regardless of whether the inode actually employs inline extended attributes. This loading process bypasses normal validation checks that would typically occur in sanity_check_inode() which only applies range restrictions when the FI_INLINE_XATTR flag is set. Consequently, inodes that contain inline directory entries or data but lack the inline xattr flag retain attacker-controlled values for i_inline_xattr_size.
The vulnerability exploitation pathway begins with get_inline_xattr_addrs() function returning this unchecked value without any conditional gating based on inode flags. This unvalidated parameter then feeds downstream calculations including MAX_INLINE_DATA(), NR_INLINE_DENTRY(), and addrs_per_page() formulas, where large values for i_inline_xattr_size cause negative results in mathematical operations.
The operational impact becomes evident when processing inline directories through f2fs_fill_dentries() function, where a negative d->max value causes unsigned long bit_pos comparisons against huge positive bounds, resulting in out-of-bounds memory reads. This condition also affects regular file processing by corrupting ADDRS_PER_INODE calculations and can potentially lead to arbitrary code execution or system instability.
This vulnerability maps directly to CWE-129 Input Validation and CWE-787 Out-of-bounds Read categories within the Common Weakness Enumeration framework, representing a classic case of insufficient input sanitization combined with unchecked arithmetic operations. The ATT&CK framework categorizes this as a privilege escalation vector through kernel memory corruption, potentially enabling local attackers to execute arbitrary code with kernel privileges.
The recommended mitigation involves implementing comprehensive validation of i_inline_xattr_size whenever the flexible_inline_xattr feature is active, ensuring values remain within acceptable bounds defined by MAX_INLINE_XATTR_SIZE. The solution must maintain the MIN_INLINE_XATTR_SIZE lower bound only for inodes that actually contain inline extended attributes while allowing legitimate inodes with i_inline_xattr_size values of zero to pass validation, thus preserving normal filesystem operations while eliminating the attack surface.