8.4

CVE-2026-63818: linux

CVSS: 8.4v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-63818DEBIAN-CVE-2026-63818
Published 19-07-2026Last modified 17-08-2026
Open JSON

Vulnerability summary

CVE-2026-63818 is a high (CVSS 8.4) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.9% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.14%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 21
MGASA-2026-0312OPENSUSE-SU-2026:11339-1USN-8726-1USN-8726-2USN-8726-3USN-8726-4

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead. Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.180-1 | < 6.12.96-1 | < 7.1.3-1
  • linux-6.12< 6.12.100-1~deb12u1
Linux1 product
  • linux≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < 210c210c92d78fdf5051bc55c5c69044b1a2150a | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < ad101d15716f5a24d1fa82a849f80430c805a3dd | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70 | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < d2f236196d542ccd8505736e41c3a1d3f0305f6f | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < 550511a2470f6d204fa07b331f048bd2d3c51280 | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < 8aad54746c251f2c2370118df766c0c82e2d2091 | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < 2e12381d4495dc8b0ff042c6856022b2e359835c | ≥ 127e670abfa7fa150f6550d620ded930f5bdb4e7, < 846c499a65816d13f1186e3090e825e8bb8bcb8b | 3.8

3 vendors · 172 products

References

32 links
Show all 32 references