CVE-2026-63816None▾ Sunlit

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_ino…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 19, 2026

Updated

Jul 19, 2026

CVSS

—

Vendor

—

Product

—

CWE

—

Depth score

3 · Minimal

EPSS

0.13% · p3

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Jul 20.

0.2% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 1 day

Jul 19, 2026Published
Disclosed via NVD
Jul 20, 2026EPSS first tracked
0.2%

#nvd

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
f2fs_gc
gc_data_segment
ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_inode->i_mapping : f2fs_is_cow_file(cow_inode) is true - f2fs_evict_inode(atomic_inode) - clear_inode_flag(fi->cow_inode, FI_COW_FILE) - F2FS_I(fi->cow_inode)->atomic_inode = NULL ... - truncate_inode_pages_final(atomic_inode) - f2fs_grab_cache_folio(mapping) : create folio in atomic_inode->mapping - clear_inode(atomic_inode) - BUG_ON(atomic_inode->i_data.nrpages)

We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

#nvd

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink

f2fs_gc

gc_data_segment

ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_inode->i_mapping : f2fs_is_cow_file(cow_inode) is true - f2fs_evict_inode(atomic_inode) - clear_inode_flag(fi->cow_inode, FI_COW_FILE) - F2FS_I(fi->cow_inode)->atomic_inode = NULL ... - truncate_inode_pages_final(atomic_inode) - f2fs_grab_cache_folio(mapping) : create folio in atomic_inode->mapping - clear_inode(atomic_inode) - BUG_ON(atomic_inode->i_data.nrpages)

We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.