7.8

CVE-2026-63812: linux

CVSS: 7.8v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-63812DEBIAN-CVE-2026-63812
Published 19-07-2026Last modified 17-08-2026
Open JSON

Vulnerability summary

CVE-2026-63812 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.13%
0%100%
Low · -0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 12
MGASA-2026-0312OPENSUSE-SU-2026:11339-1USN-8726-1USN-8726-2USN-8726-3USN-8726-4

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

-0.05 pp

From 0.18% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu131 products
  • linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.12.95-1 | < 7.1.3-1
Linux1 product
  • linux≥ 42dd1c91f993431d0b399502479d00e6ad1bca71, < 7e4d8f98be63f98856a5176b9188dada6e7ba9ee | ≥ ab1eaf9d5c99042f5b0243bf67a06283a4c0757f, < 58a5deb220bcac4c73bf58954c0845644c997487 | ≥ b0e4395870eb3441ddc959f6710b5f6ca61aff26, < 20190e498057997532c7f186d081011f18e0a462 | ≥ ed78aeebef05212ef7dca93bd931e4eff67c113f, < edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7 | ≥ ed78aeebef05212ef7dca93bd931e4eff67c113f, < 1f70ddb28a3c71df124da5fa4040c808116d6bb9 | 0559a0e962aacbb47519e26ee663be04b72dcb92 | ≥ 6.6.140, < 6.6.144 | ≥ 6.12.88, < 6.12.95 | ≥ 6.18.30, < 6.18.38 | ≥ 7.0.7, < 7.1 | 7.1

3 vendors · 133 products

References

20 links
Show all 20 references