CVE-2026-63817 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate compress cache inode only when enabled
F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress_cache mount option is enabled.
When compress_cache is disabled, max_nid is outside the valid inode range. A corrupted directory entry that points to ino == max_nid should therefore be rejected by f2fs_check_nid_range(). However, is_meta_ino() currently treats F2FS_COMPRESS_INO() as a meta inode unconditionally, so f2fs_iget() bypasses do_read_inode() and its nid range check, and instantiates a fake internal inode instead.
Gate the compressed cache inode case on COMPRESS_CACHE, matching f2fs_init_compress_inode(). With compress_cache disabled, ino == max_nid now follows the normal inode path and is rejected as an out-of-range nid.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the F2FS (Flash-Friendly File System) implementation in the Linux kernel where a flaw exists in how compressed cache inodes are validated during inode instantiation. The issue stems from the F2FS_COMPRESS_INO() macro which utilizes NM_I(sbi)->max_nid as a synthetic inode number for managing compressed page cache inodes. This mechanism operates exclusively when the compress_cache mount option is enabled, creating a conditional dependency that becomes problematic when the feature is disabled. When compress_cache functionality is turned off, max_nid falls outside the legitimate inode range boundaries, yet the system fails to properly validate these conditions during inode creation processes.
The technical flaw manifests through the is_meta_ino() function which unconditionally treats F2FS_COMPRESS_INO() as a metadata inode regardless of whether the compress_cache feature is active. This unconditional treatment causes f2fs_iget() to bypass the standard do_read_inode() routine that contains crucial nid range validation through f2fs_check_nid_range(). As a result, when a corrupted directory entry attempts to reference an inode number equal to max_nid while compress_cache is disabled, the system incorrectly instantiates a fake internal inode instead of properly rejecting the invalid reference. This bypass represents a direct violation of proper input validation mechanisms and creates a potential pathway for unauthorized inode manipulation or information disclosure.
The operational impact of this vulnerability extends beyond simple validation failures, potentially enabling attackers to exploit the inconsistent state handling between enabled and disabled compress_cache modes. When the compress_cache feature is disabled, the system should maintain strict validation boundaries, but instead allows malformed directory entries to proceed through an alternative code path that circumvents normal security checks. This creates a scenario where corrupted filesystem metadata could be processed in a manner that bypasses fundamental inode range constraints, potentially leading to system instability or unauthorized access patterns.
The mitigation strategy involves implementing proper conditional logic that gates the compressed cache inode handling specifically on the COMPRESS_CACHE flag, aligning with the existing f2fs_init_compress_inode() implementation pattern. This ensures that when compress_cache is disabled, ino == max_nid follows the standard inode processing path and properly undergoes range validation through normal error handling mechanisms. The fix directly addresses the root cause by ensuring that compressed cache inode logic only executes when the feature is actually enabled, thereby maintaining consistent validation behavior across all operational states. This approach aligns with established security practices for conditional feature implementation and proper input validation as recommended in common security frameworks such as those referenced in CWE-129 and ATT&CK techniques related to privilege escalation through file system manipulation.
The vulnerability demonstrates a classic case of improper conditional logic in kernel space where feature-specific code paths fail to respect the operational state of their dependent features. This type of flaw represents a security boundary violation that could potentially enable attackers to manipulate filesystem metadata in unexpected ways, particularly when transitioning between different mount option states. The fix ensures proper state awareness and maintains consistent validation across all system configurations while preserving functionality for users who actively utilize the compress_cache feature.
The resolution directly addresses CWE-129 which covers insufficient input validation and CWE-347 which pertains to improper certificate validation, though in this case the focus is on inode validation boundaries rather than cryptographic validation. The ATT&CK framework would classify this under privilege escalation techniques related to file system manipulation where attackers could potentially exploit inconsistent validation logic to gain unauthorized access to system resources through malformed metadata references.
This vulnerability highlights the importance of maintaining consistent security boundaries even within complex filesystem implementations, particularly when dealing with conditional feature activation patterns. The proper implementation ensures that all code paths maintain appropriate validation checks regardless of feature state, preventing potential exploitation vectors that arise from incomplete conditional logic implementation in kernel subsystems.