CVE-2026-63811

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63811", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.013Z", "datePublished": "2026-07-19T12:02:13.057Z", "dateUpdated": "2026-10-21T12:42:37.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:37.074Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: read COW data with the original inode during atomic write\n\nWhen updating an atomic-write file, f2fs_write_begin() may read the\npreviously written data back from the COW inode:\nprepare_atomic_write_begin() locates the block in the COW inode and sets\nuse_cow, and the read bio is then built with the COW inode:\n\n\tf2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode,\n\t\t\t ...);\n\nand f2fs_grab_read_bio() decides whether to schedule fs-layer decryption\n(STEP_DECRYPT) for the bio based on that inode via\nfscrypt_inode_uses_fs_layer_crypto().\n\nHowever, the folio being filled belongs to the original inode\n(folio->mapping->host == inode), and the data stored in the COW block was\nencrypted (or left as plaintext) using the original inode's context, not\nthe COW inode's -- see f2fs_encrypt_one_page(), which keys off\nfio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise\noperates on folio->mapping->host.\n\nThe COW inode is created as a tmpfile in the parent directory and inherits\nits encryption policy from there. With test_dummy_encryption the newly\ncreated COW inode gets the dummy policy and becomes encrypted, while a\npre-existing regular file -- created before the policy applied, e.g.\nalready present in the on-disk image -- stays unencrypted. The read\npath then sets STEP_DECRYPT based on the encrypted COW inode and calls\nfscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted\noriginal inode) has a NULL ->i_crypt_info, dereferencing it:\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310\n Workqueue: f2fs_post_read_wq f2fs_post_read_work\n Call Trace:\n fscrypt_decrypt_bio+0x1eb/0x340\n f2fs_post_read_work+0xba/0x140\n process_one_work+0x91c/0x1a40\n worker_thread+0x677/0xe90\n kthread+0x2bc/0x3a0\n\nThe COW inode is only needed to locate the on-disk block, and that block\naddress is already resolved into @blkaddr by prepare_atomic_write_begin()\nvia __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads\nfrom that physical @blkaddr directly, so the inode argument only selects\nthe post-read crypto context, not which block is fetched. Reading with\n@inode therefore returns the same (latest, not-yet-committed) COW data,\nwhile making both the fs-layer decryption decision and the inline crypto\npath use the correct (original inode's) key.\n\nWith the COW inode no longer used at the read site, the use_cow flag has no\nremaining consumer; drop it from f2fs_write_begin() and\nprepare_atomic_write_begin()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/data.c"], "versions": [{"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "lessThan": "bcc9df992f3cbc43f2ecfe0b22e428e50f326e72", "status": "affected", "versionType": "git"}, {"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "lessThan": "655d55c5740d37ffdf6233ff5fe21cea879407f1", "status": "affected", "versionType": "git"}, {"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "lessThan": "7e4ab3907f44dc243d026048d7f5d477dae9267b", "status": "affected", "versionType": "git"}, {"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "lessThan": "a92332f32a8d31a7eee47b1dc1d751cb3319908f", "status": "affected", "versionType": "git"}, {"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "lessThan": "a41075acde0124d2f8a5f563068a5d63e8ffd57b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/data.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bcc9df992f3cbc43f2ecfe0b22e428e50f326e72"}, {"url": "https://git.kernel.org/stable/c/655d55c5740d37ffdf6233ff5fe21cea879407f1"}, {"url": "https://git.kernel.org/stable/c/7e4ab3907f44dc243d026048d7f5d477dae9267b"}, {"url": "https://git.kernel.org/stable/c/a92332f32a8d31a7eee47b1dc1d751cb3319908f"}, {"url": "https://git.kernel.org/stable/c/a41075acde0124d2f8a5f563068a5d63e8ffd57b"}], "title": "f2fs: read COW data with the original inode during atomic write", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/data.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bcc9df992f3cbc43f2ecfe0b22e428e50f326e72", "status": "affected", "version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "versionType": "git"}, {"lessThan": "655d55c5740d37ffdf6233ff5fe21cea879407f1", "status": "affected", "version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "versionType": "git"}, {"lessThan": "7e4ab3907f44dc243d026048d7f5d477dae9267b", "status": "affected", "version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "versionType": "git"}, {"lessThan": "a92332f32a8d31a7eee47b1dc1d751cb3319908f", "status": "affected", "version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "versionType": "git"}, {"lessThan": "a41075acde0124d2f8a5f563068a5d63e8ffd57b", "status": "affected", "version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/data.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "54397279-D47C-4BF4-9212-AB36CC8762B1", "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6209C78-7745-495E-92DC-3CD950D149EE", "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C630600E-44E2-4A75-9937-F6EEF31F171F", "versionEndExcluding": "6.18.57", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: read COW data with the original inode during atomic write\n\nWhen updating an atomic-write file, f2fs_write_begin() may read the\npreviously written data back from the COW inode:\nprepare_atomic_write_begin() locates the block in the COW inode and sets\nuse_cow, and the read bio is then built with the COW inode:\n\n\tf2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode,\n\t\t\t ...);\n\nand f2fs_grab_read_bio() decides whether to schedule fs-layer decryption\n(STEP_DECRYPT) for the bio based on that inode via\nfscrypt_inode_uses_fs_layer_crypto().\n\nHowever, the folio being filled belongs to the original inode\n(folio->mapping->host == inode), and the data stored in the COW block was\nencrypted (or left as plaintext) using the original inode's context, not\nthe COW inode's -- see f2fs_encrypt_one_page(), which keys off\nfio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise\noperates on folio->mapping->host.\n\nThe COW inode is created as a tmpfile in the parent directory and inherits\nits encryption policy from there. With test_dummy_encryption the newly\ncreated COW inode gets the dummy policy and becomes encrypted, while a\npre-existing regular file -- created before the policy applied, e.g.\nalready present in the on-disk image -- stays unencrypted. The read\npath then sets STEP_DECRYPT based on the encrypted COW inode and calls\nfscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted\noriginal inode) has a NULL ->i_crypt_info, dereferencing it:\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310\n Workqueue: f2fs_post_read_wq f2fs_post_read_work\n Call Trace:\n fscrypt_decrypt_bio+0x1eb/0x340\n f2fs_post_read_work+0xba/0x140\n process_one_work+0x91c/0x1a40\n worker_thread+0x677/0xe90\n kthread+0x2bc/0x3a0\n\nThe COW inode is only needed to locate the on-disk block, and that block\naddress is already resolved into @blkaddr by prepare_atomic_write_begin()\nvia __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads\nfrom that physical @blkaddr directly, so the inode argument only selects\nthe post-read crypto context, not which block is fetched. Reading with\n@inode therefore returns the same (latest, not-yet-committed) COW data,\nwhile making both the fs-layer decryption decision and the inline crypto\npath use the correct (original inode's) key.\n\nWith the COW inode no longer used at the read site, the use_cow flag has no\nremaining consumer; drop it from f2fs_write_begin() and\nprepare_atomic_write_begin()."}], "id": "CVE-2026-63811", "lastModified": "2026-11-10T20:11:43.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T12:16:54.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/655d55c5740d37ffdf6233ff5fe21cea879407f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e4ab3907f44dc243d026048d7f5d477dae9267b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a41075acde0124d2f8a5f563068a5d63e8ffd57b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a92332f32a8d31a7eee47b1dc1d751cb3319908f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bcc9df992f3cbc43f2ecfe0b22e428e50f326e72"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: f2fs: read COW data with the original inode during atomic write", "id": "2502228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502228"}, "csaw": false, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nf2fs: read COW data with the original inode during atomic write\nWhen updating an atomic-write file, f2fs_write_begin() may read the\npreviously written data back from the COW inode:\nprepare_atomic_write_begin() locates the block in the COW inode and sets\nuse_cow, and the read bio is then built with the COW inode:\nf2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode,\n...);\nand f2fs_grab_read_bio() decides whether to schedule fs-layer decryption\n(STEP_DECRYPT) for the bio based on that inode via\nfscrypt_inode_uses_fs_layer_crypto().\nHowever, the folio being filled belongs to the original inode\n(folio->mapping->host == inode), and the data stored in the COW block was\nencrypted (or left as plaintext) using the original inode's context, not\nthe COW inode's -- see f2fs_encrypt_one_page(), which keys off\nfio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise\noperates on folio->mapping->host.\nThe COW inode is created as a tmpfile in the parent directory and inherits\nits encryption policy from there. With test_dummy_encryption the newly\ncreated COW inode gets the dummy policy and becomes encrypted, while a\npre-existing regular file -- created before the policy applied, e.g.\nalready present in the on-disk image -- stays unencrypted. The read\npath then sets STEP_DECRYPT based on the encrypted COW inode and calls\nfscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted\noriginal inode) has a NULL ->i_crypt_info, dereferencing it:\nOops: general protection fault, probably for non-canonical address ...\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nRIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310\nWorkqueue: f2fs_post_read_wq f2fs_post_read_work\nCall Trace:\nfscrypt_decrypt_bio+0x1eb/0x340\nf2fs_post_read_work+0xba/0x140\nprocess_one_work+0x91c/0x1a40\nworker_thread+0x677/0xe90\nkthread+0x2bc/0x3a0\nThe COW inode is only needed to locate the on-disk block, and that block\naddress is already resolved into @blkaddr by prepare_atomic_write_begin()\nvia __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads\nfrom that physical @blkaddr directly, so the inode argument only selects\nthe post-read crypto context, not which block is fetched. Reading with\n@inode therefore returns the same (latest, not-yet-committed) COW data,\nwhile making both the fs-layer decryption decision and the inline crypto\npath use the correct (original inode's) key.\nWith the COW inode no longer used at the read site, the use_cow flag has no\nremaining consumer; drop it from f2fs_write_begin() and\nprepare_atomic_write_begin().", "A flaw was found in the Linux kernel's f2fs filesystem. During an atomic write operation, the system may attempt to decrypt data using an incorrect encryption context, specifically when the original file is unencrypted but its Copy-On-Write (COW) inode is encrypted. This mismatch can lead to a null-pointer dereference, causing a kernel crash and resulting in a Denial of Service (DoS) for the affected system. A local user could potentially trigger this vulnerability."], "name": "CVE-2026-63811", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63811\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63811\nhttps://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63811-b686@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd,a92332f32a8d31a7eee47b1dc1d751cb3319908f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd,a41075acde0124d2f8a5f563068a5d63e8ffd57b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.3,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T13:30:07.003016+00:00", "updated": "2026-07-30T22:30:06.737437+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}