# CVE-2026-63815: linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: bound i_inline_xattr_size for non-inline-x...

CVE-2026-63815 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-63815, released July 20, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-63815
- Priority: High
- CVSS: 8.4 (high)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 19, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: bound i_inline_xattr_size for non-inline-xattr inodes  When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally:  	if (f2fs_sb_has_flexible_inline_xattr(sbi)) 		fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);  but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set.  An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image.  get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry:  	MAX_INLINE_DATA()  = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) 	NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...) 	addrs_per_page()   = CUR_ADDRS_PER_INODE - i_inline_xattr_size  A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value.  The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area:  	while (bit_pos < d->max)		/* fs/f2fs/dir.c */ 		... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...  Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files.  Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-63815](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63815.md) | Jul 20, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.96-1 | [DEBIAN-CVE-2026-63815](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63815.md) | Jul 20, 2026 |
| Linux | linux Debian 14 | 7.1.3-1 | [DEBIAN-CVE-2026-63815](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63815.md) | Jul 20, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.100-1~deb12u1 | [DEBIAN-CVE-2026-63815](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63815.md) | Jul 20, 2026 |

---

Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.