{
  "cveId": "CVE-2026-63819",
  "url": "https://patchblox.com/security/cve/CVE-2026-63819",
  "summary": "CVE-2026-63819 is fixed in linux on 1 platform by DEBIAN-CVE-2026-63819 (version 7.1.3-1), released July 20, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "f2fs: fix to do sanity check on f2fs_get_node_folio_ra()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on f2fs_get_node_folio_ra()  kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 \u002B ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_do_truncate_blocks\u002B0x1115/0x1140 fs/f2fs/file.c:845 Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 \u003C0f\u003E 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90 RSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283 RAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000 RDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504 RBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002 R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c FS:  00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff0305c4000 CR3: 0000000012d4c000 CR4: 0000000000352ef0 Call Trace:  \u003CTASK\u003E  f2fs_truncate_blocks\u002B0x10a/0x300 fs/f2fs/file.c:882  f2fs_truncate\u002B0x471/0x7c0 fs/f2fs/file.c:940  f2fs_evict_inode\u002B0xa3f/0x1ac0 fs/f2fs/inode.c:907  evict\u002B0x61e/0xb10 fs/inode.c:841  f2fs_fill_super\u002B0x5f43/0x78f0 fs/f2fs/super.c:5224  get_tree_bdev_flags\u002B0x431/0x4f0 fs/super.c:1694  vfs_get_tree\u002B0x92/0x2a0 fs/super.c:1754  fc_mount fs/namespace.c:1193 [inline]  do_new_mount_fc fs/namespace.c:3758 [inline]  do_new_mount\u002B0x341/0xd30 fs/namespace.c:3834  do_mount fs/namespace.c:4167 [inline]  __do_sys_mount fs/namespace.c:4383 [inline]  __se_sys_mount\u002B0x31d/0x420 fs/namespace.c:4360  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64\u002B0x15f/0xf80 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  \tcount = ADDRS_PER_PAGE(dn.node_folio, inode);  \tcount -= dn.ofs_in_node; \tf2fs_bug_on(sbi, count \u003C 0);  The fuzz test will trigger above bug_on in f2fs.  The root cause should be: in the corrupted inode, there is a direct node which has the same ino and nid in its footer, so in f2fs_do_truncate_blocks(), after f2fs_get_dnode_of_data() finds such dnode: 1) ADDRS_PER_PAGE(dn.node_folio, inode) will return 923 2) once dn.ofs_in_node points to addr[923, 1017] Then it will trigger the system panic.  Let\u0027s introduce NODE_TYPE_NON_IXNODE to indicate current node should not be an inode or xattr node, and then use it in below path to detect inconsistent node chain in inode mapping table:  - f2fs_do_truncate_blocks  - f2fs_get_dnode_of_data   - f2fs_get_node_folio_ra    -  __get_node_folio     - f2fs_sanity_check_node_footer      - case NODE_TYPE_NON_IXNODE -\u003E check whether it is inode|xnode",
  "published": "2026-07-19T12:16:54Z",
  "severity": "Moderate",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00125,
  "epssPercentile": 0.02224,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63819",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.3-1",
      "fix": "DEBIAN-CVE-2026-63819",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63819",
      "released": "2026-07-20T12:58:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}