CVE-2026-63814

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate ACL entry sizes in f2fs_acl_from_disk()

f2fs_acl_count() only validates the aggregate ACL xattr length. A

malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only

contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk()

then reads entry->e_id before verifying that a full entry fits.

Require a short entry before reading e_tag and e_perm, and require a

full entry before reading e_id for ACL_USER and ACL_GROUP. Return

-EFSCORRUPTED from these new truncated-entry checks, while keeping the

pre-existing -EINVAL paths unchanged.

Validation reproduced this kernel report:

KASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0

RIP: 0033:0x7f4b835ea7aa

The buggy address belongs to the object at ffff888114589960 which belongs

to the cache kmalloc-8 of size 8

The buggy address is located 0 bytes to the right of allocated 8-byte

region [ffff888114589960, ffff888114589968)

Read of size 4

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References