Vulnerability in Linux

CVE-2026-63812

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.

EPSS: 0.002 (7.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Linux — versions ed78aeebef05212ef7dca93bd931e4eff67c113f, 7.1, 42dd1c91f993431d0b399502479d00e6ad1bca71

References

Frequently asked questions

What is CVE-2026-63812?
CVE-2026-63812 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2026-07-19.
How severe is CVE-2026-63812?
High severity. CVSS v3 base score is 7.8 out of 10.