CVE-2026-63814

What it actually does

This vulnerability is an out-of-bounds read in the Linux kernel F2FS filesystem ACL parsing path. A malformed F2FS access-control-list extended attribute can encode an ACL_USER or ACL_GROUP entry in a truncated slot. During ACL conversion from on-disk format, the kernel may read the entry ID field before confirming that a full ACL entry is present. When triggered through ACL or extended-attribute access, such as getxattr-style operations, the bug can cause kernel memory corruption symptoms, kernel crashes, and potentially broader local privilege-impact depending on kernel configuration, allocator state, and exploitability conditions.

Why it matters to the business

Systems that mount or process untrusted F2FS filesystems could be destabilized by a local user or by malicious removable/media images, resulting in crashes, service interruption, and possible compromise of host integrity. The issue is not currently listed in CISA KEV, has no known mature public exploit in the provided data, and has low EPSS, but the CVSS impact is high because successful exploitation occurs in kernel context and can affect confidentiality, integrity, and availability.

How an attack unfolds

An attacker first needs local access to a vulnerable Linux system or a way to cause the system to mount or inspect a crafted F2FS filesystem. The attacker prepares an F2FS image or file metadata containing a malformed ACL extended attribute whose total length passes the existing aggregate-length validation but whose individual ACL entry is truncated. When a privileged or unprivileged process requests ACL metadata from the affected file, the kernel enters the F2FS ACL parsing path. The vulnerable code reads the ACL entry ID before verifying that enough bytes exist for a full ACL_USER or ACL_GROUP entry. This can produce an out-of-bounds read in kernel memory, leading to a kernel fault, denial of service, or potentially more severe local impact if the memory access can be shaped reliably.

How to fix it

Update the Linux kernel to a vendor-supported version that includes the F2FS ACL validation fix for f2fs_acl_from_disk(). The fix requires validating that a short ACL entry is present before reading e_tag and e_perm and validating that a full ACL entry is present before reading e_id for ACL_USER and ACL_GROUP entries. Where immediate patching is not possible, reduce exposure by preventing untrusted users from mounting F2FS filesystems, disabling automount of removable media where feasible, limiting access to loop-device mounting, and avoiding processing untrusted F2FS disk images on production systems. Apply normal kernel-hardening controls such as restricting unprivileged user namespaces and removable-media workflows, but treat these as mitigations rather than substitutes for patching.

How to confirm the fix worked

Confirm that the running kernel package includes the upstream or vendor patch for F2FS ACL entry-size validation in fs/f2fs/acl.c. Validate with the distribution vendor advisory, kernel changelog, or source diff showing truncated-entry checks in f2fs_acl_from_disk(). Inventory systems that have F2FS support enabled or mounted F2FS filesystems using commands such as findmnt -t f2fs, mount | grep f2fs, lsmod | grep f2fs, and kernel configuration checks for CONFIG_F2FS_FS. After remediation, verify that the host is booted into the updated kernel, not merely that the package is installed. In test environments, malformed F2FS ACL test cases should return a filesystem-corruption or validation error rather than producing KASAN, BUG, oops, panic, or slab-out-of-bounds reports.

Typical attack path

1. Gain local code execution on a vulnerable Linux host, or provide a crafted F2FS filesystem image or removable storage device that the host will mount or inspect.
2. Create or deliver F2FS metadata with a malformed ACL extended attribute containing a truncated ACL_USER or ACL_GROUP entry.
3. Trigger ACL retrieval by invoking ACL or extended-attribute operations against the crafted file metadata.
4. Cause the vulnerable F2FS ACL parser to read beyond the allocated ACL entry buffer.
5. Leverage the resulting kernel fault for denial of service, or attempt further exploitation depending on kernel hardening and memory layout.

How to detect it

Review kernel logs and crash telemetry for signs that the F2FS ACL parser accessed memory out of bounds. Relevant sources include dmesg, journald kernel logs, /var/log/kern.log, /var/log/messages, crash dump systems such as kdump, EDR kernel-event telemetry, and hypervisor or fleet crash reporting. Look for KASAN reports, kernel oopses, panics, or BUG messages containing __f2fs_get_acl, f2fs ACL parsing, fs/f2fs/acl.c, getxattr, vfs_get_acl, do_get_acl, or path_getxattrat. Correlate these events with recent mounting of F2FS filesystems, insertion of removable media, loop-device usage, container or sandbox image processing, or forensic tooling that inspects disk images. If exploitation is suspected, collect the triggering F2FS image or device, shell history and audit logs for mount/losetup/getfattr/getfacl activity, and kernel crash artifacts before remediating. There are no reliable network indicators because exploitation is local and filesystem-mediated.

• KASAN slab-out-of-bounds in __f2fs_get_acl
• __f2fs_get_acl+0x
• fs/f2fs/acl.c:169
• Read of size 4
• The buggy address belongs to the object
• kmalloc-8 of size 8
• vfs_get_acl
• do_get_acl
• do_getxattr
• filename_getxattr
• path_getxattrat
• f2fs_acl_from_disk
• EFSCORRUPTED
• mount -t f2fs
• losetup
• getfattr
• getfacl

What your security team should do

• Prioritize patching Linux systems that mount F2FS filesystems, process mobile/removable storage, run forensic image ingestion, or allow users to mount loopback filesystems.
• Identify and restrict workflows where untrusted F2FS images or removable media are mounted automatically or by low-privileged users.
• Verify that patched kernel packages are installed and that systems have rebooted into the fixed kernel.
• Hunt kernel logs for F2FS ACL parsing crashes, KASAN slab-out-of-bounds reports, and call traces involving __f2fs_get_acl or fs/f2fs/acl.c.
• If suspicious crashes are found, preserve kernel logs, mounted image artifacts, removable-media details, and relevant filesystem images for forensic review.
• Because exploit maturity is currently listed as none and the issue is not in KEV, handle as a high-impact local kernel bug rather than an internet-scale emergency, while still patching promptly on exposed F2FS-capable systems.