Out-of-bounds read in Linux kernel - CVE-2026-63815

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in f2fs_fill_dentries() and inline directory handling when mounting a crafted filesystem image and reading an inline directory. A local user can mount a specially crafted image and read a crafted directory to disclose sensitive information.

Exploitation requires the flexible_inline_xattr feature to be enabled.

Affected software

How to mitigate CVE-2026-63815

External References

• https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed
• https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706
• https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8
• https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d

Related Security Bulletins

• Out-of-bounds read in Linux kernel f2fs
• Debian update for linux