Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63815— f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于在启用flexible_inline_xattr特性时，未对非内联xattr的inode的i_inline_xattr_size参数进行有效边界检查，导致能够从特制镜像中控制该参数，进而引发越界读取和内存损坏。

CVSS 8.4 · High EPSS 0.14% · P4

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 6afc662e68b5f988282ff20afd58a89b1c279dca< 3c8d6b4093aea40a20596f452289e7c22d84e6d5 affected
6afc662e68b5f988282ff20afd58a89b1c279dca< a08ee30dcbeff6b97df75c38c2589603ddde53a6 affected
6afc662e68b5f988282ff20afd58a89b1c279dca< c3e05522daae4e7348a1ea81eeb321d25aa0fd3b affected
6afc662e68b5f988282ff20afd58a89b1c279dca< 76e1a05cf6d4051931d7fa4ead51a05786a62918 affected
6afc662e68b5f988282ff20afd58a89b1c279dca< 2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706 affected
6afc662e68b5f988282ff20afd58a89b1c279dca< 4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d affected
6afc662e68b5f988282ff20afd58a89b1c279dca< 16bc237ce3c483b75575abea53cfb639745311ed affected
6afc662e68b5f988282ff20afd58a89b1c279dca< 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63815

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally: if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size); but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image. get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry: MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...) addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area: while (bit_pos < d->max) /* fs/f2fs/dir.c */ ... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ... Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files. Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于在启用flexible_inline_xattr特性时，未对非内联xattr的inode的i_inline_xattr_size参数进行有效边界检查，导致能够从特制镜像中控制该参数，进而引发越界读取和内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6afc662e68b5f988282ff20afd58a89b1c279dca ~ 3c8d6b4093aea40a20596f452289e7c22d84e6d5 -
Linux Linux 4.15 -

II. Public POCs for CVE-2026-63815

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63815

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63815 (7)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-64102 9.8 CRITICAL RDMA/siw: Reject MPA FPDU length underflow before signed receive math
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-63924 9.8 CRITICAL ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
CVE-2026-63922 9.8 CRITICAL ipv6: exthdrs: refresh nh after handling HAO option
CVE-2026-63857 9.8 CRITICAL net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-64162 9.8 CRITICAL idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-64055 9.8 CRITICAL net: ethernet: cortina: Carry over frag counter
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()
CVE-2026-64056 9.8 CRITICAL net: ethernet: cortina: Make RX SKB per-port
CVE-2026-63888 9.8 CRITICAL scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-63815

No comments yet

Leave a comment