CVE-2026-63813

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"

This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598.

The kernel panics are keeping to be reported especially when the f2fs

partition get almost full. By investigation, we find that the reason is

one f2fs page got freed to buddy without being deleted from LRU and the

root cause is the race happened in [2] which is enrolled by this commit.

There are 3 race processes in this scenario, please find below for their

main activities.

The changed code in move_data_block() lets the GC path evict the tail-end

folio from the page cache through folio_end_dropbehind(). Once

folio_unmap_invalidate() removes the folio from mapping->i_pages, the

page-cache references for all pages in the folio are dropped. The folio

is then kept alive only by temporary external references, which allows a

later split to operate on a folio whose subpages are n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References