CVE-2026-63811

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: read COW data with the original inode during atomic write

When updating an atomic-write file, f2fs_write_begin() may read the

previously written data back from the COW inode:

prepare_atomic_write_begin() locates the block in the COW inode and sets

use_cow, and the read bio is then built with the COW inode:

f2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode,

...);

and f2fs_grab_read_bio() decides whether to schedule fs-layer decryption

(STEP_DECRYPT) for the bio based on that inode via

fscrypt_inode_uses_fs_layer_crypto().

However, the folio being filled belongs to the original inode

(folio->mapping->host == inode), and the data stored in the COW block was

encrypted (or left as plaintext) using the original inode's context, not

the COW inode's -- see f2fs_encrypt_one_page(), which keys off

fio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise

operates on folio->mapping

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References