CVE-2026-63819 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845 Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 <0f> 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90 RSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283 RAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000 RDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504 RBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002 R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c FS: 00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff0305c4000 CR3: 0000000012d4c000 CR4: 0000000000352ef0 Call Trace: <TASK> f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:882 f2fs_truncate+0x471/0x7c0 fs/f2fs/file.c:940 f2fs_evict_inode+0xa3f/0x1ac0 fs/f2fs/inode.c:907 evict+0x61e/0xb10 fs/inode.c:841 f2fs_fill_super+0x5f43/0x78f0 fs/f2fs/super.c:5224 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694 vfs_get_tree+0x92/0x2a0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834 do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
count = ADDRS_PER_PAGE(dn.node_folio, inode);
count -= dn.ofs_in_node; f2fs_bug_on(sbi, count < 0);
The fuzz test will trigger above bug_on in f2fs.
The root cause should be: in the corrupted inode, there is a direct node which has the same ino and nid in its footer, so in f2fs_do_truncate_blocks(), after f2fs_get_dnode_of_data() finds such dnode: 1) ADDRS_PER_PAGE(dn.node_folio, inode) will return 923 2) once dn.ofs_in_node points to addr[923, 1017]
Then it will trigger the system panic.
Let's introduce NODE_TYPE_NON_IXNODE to indicate current node should not be an inode or xattr node, and then use it in below path to detect inconsistent node chain in inode mapping table:
- f2fs_do_truncate_blocks - f2fs_get_dnode_of_data - f2fs_get_node_folio_ra - __get_node_folio - f2fs_sanity_check_node_footer - case NODE_TYPE_NON_IXNODE -> check whether it is inode|xnode
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical kernel panic condition within the f2fs filesystem implementation in the Linux kernel, specifically triggered during truncate operations on corrupted inodes. This flaw manifests as an invalid opcode exception leading to system crash, with the bug occurring at line 845 in fs/f2fs/file.c. The root cause stems from improper validation of node structures during data node traversal, where a corrupted inode contains a direct node with conflicting metadata that results in negative count values during address calculations. This condition directly violates kernel safety assumptions and can be exploited through targeted fuzz testing to trigger immediate system termination.
The technical flaw occurs when f2fs_do_truncate_blocks processes a corrupted inode structure, specifically during the execution of f2fs_get_dnode_of_data which retrieves data nodes for truncation operations. The calculation ADDRS_PER_PAGE(dn.node_folio, inode) returns 923 while dn.ofs_in_node points to an address range spanning from 923 to 1017, causing count to become negative and subsequently triggering the f2fs_bug_on macro with a negative value check. This represents a classic buffer overflow condition where array indexing calculations produce invalid memory access patterns that the kernel cannot safely handle. The vulnerability is categorized under CWE-129 as an improper validation of array index and specifically aligns with ATT&CK technique T1068 for privilege escalation through kernel exploitation.
The operational impact of this vulnerability extends beyond simple system crashes to potential denial-of-service scenarios that can be reliably triggered by malicious actors. The panic occurs during normal filesystem operations such as truncate calls, making it particularly dangerous in production environments where system stability is critical. Attackers could exploit this condition through carefully crafted filesystem corruption or memory manipulation techniques to cause system-wide service disruption. The vulnerability affects systems running f2fs filesystems and is particularly concerning given that f2fs is commonly used in embedded systems, mobile devices, and storage solutions where kernel stability directly impacts user experience and data availability.
The proposed mitigation strategy introduces a new NODE_TYPE_NON_IXNODE flag to explicitly identify nodes that should not be inode or extended attribute nodes during metadata validation. This enhancement enables comprehensive node chain consistency checking throughout the traversal path starting from f2fs_do_truncate_blocks through f2fs_get_dnode_of_data, f2fs_get_node_folio_ra, __get_node_folio, and ultimately f2fs_sanity_check_node_footer. The solution enforces stricter validation of node type integrity within the inode mapping table, preventing corrupted data structures from being processed as valid metadata. This approach aligns with defensive programming principles and follows established kernel security patterns for preventing invalid memory access conditions, providing a robust mechanism to detect inconsistent node chain states before they can cause system crashes.
The fix addresses fundamental issues in the filesystem's metadata consistency checking mechanisms by introducing explicit type validation at multiple levels of the processing stack. The implementation ensures that when traversing node structures during data operations, the kernel explicitly verifies that nodes are not inadvertently treated as inode or xattr structures when they should be regular data nodes. This prevents cascading failures where corrupted metadata could propagate through the system and cause more widespread instability than initially intended. The solution maintains backward compatibility while strengthening the overall filesystem integrity checks, making it suitable for deployment in production environments without introducing new compatibility risks.