High 8.4Published Jul 19, 2026

CVE-2026-63818f2fs: validate orphan inode entry count

Updated under an hour ago (Oct 28, 2026, 8:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead. Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

CVSS: 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 127e670abfa7fa150f6550d620ded930f5bdb4e7 before 210c210c92d78fdf5051bc55c5c69044b1a2150a; from 127e670abfa7fa150f6550d620ded930f5bdb4e7 before ad101d15716f5a24d1fa82a849f80430c805a3dd; from 127e670abfa7fa150f6550d620ded930f5bdb4e7 before d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70; from 127e670abfa7fa150f6550d620ded930f5bdb4e7 before d2f236196d542ccd8505736e41c3a1d3f0305f6f; from 127e670abfa7fa150f6550d620ded930f5bdb4e7 before 550511a2470f6d204fa07b331f048bd2d3c51280; 127e670abfa7fa150f6550d620ded930f5bdb4e7 builds before 8aad54746c251f2c2370118df766c0c82e2d2091; 127e670abfa7fa150f6550d620ded930f5bdb4e7 builds before 2e12381d4495dc8b0ff042c6856022b2e359835c; from 127e670abfa7fa150f6550d620ded930f5bdb4e7 before 846c499a65816d13f1186e3090e825e8bb8bcb8b	CNA record

References

References

https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a
https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd
https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70
https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f
https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280
https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091
https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c
https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.