SB2026072118 - Out-of-bounds read in Linux kernel f2fs_recover_orphan_inodes()

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-63818)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_recover_orphan_inodes() when mounting a crafted f2fs image and replaying orphan inodes from the checkpoint pack. A local user can provide a crafted filesystem image with a corrupted orphan block entry count to cause a denial of service.

The issue occurs when the orphan block entry count is larger than F2FS_ORPHANS_PER_BLOCK, causing the recovery code to read past the ino[] array and interpret subsequent data as inode numbers.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c
• https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280
• https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b
• https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091