CVE-2026-63815

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

When the flexible_inline_xattr feature is enabled, do_read_inode() loads

the on-disk i_inline_xattr_size unconditionally:

if (f2fs_sb_has_flexible_inline_xattr(sbi))

fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);

but sanity_check_inode() only range-checks it when the inode also has the

FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline

data but not FI_INLINE_XATTR -- the normal layout for an inline

directory -- therefore keeps a fully attacker-controlled

i_inline_xattr_size from a crafted image.

get_inline_xattr_addrs() returns that value with no flag gating, so it

feeds the inode geometry:

MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)

NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)

addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size

A large i_inline_xat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References