CVE-2026-63813 (GCVE-0-2026-63813)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-05 12:35
VLAI
Title
Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almost full. By investigation, we find that the reason is one f2fs page got freed to buddy without being deleted from LRU and the root cause is the race happened in [2] which is enrolled by this commit. There are 3 race processes in this scenario, please find below for their main activities. The changed code in move_data_block() lets the GC path evict the tail-end folio from the page cache through folio_end_dropbehind(). Once folio_unmap_invalidate() removes the folio from mapping->i_pages, the page-cache references for all pages in the folio are dropped. The folio is then kept alive only by temporary external references, which allows a later split to operate on a folio whose subpages are no longer protected by page-cache references. After the page-cache references are gone, split_folio_to_order() can split the big folio into individual pages and put the resulting subpages back on the LRU. For tail pages beyond EOF, split removes them from the page cache and drops their page-cache references. A tail page can then remain on the LRU with PG_lru set while holding only the split caller's temporary reference. When free_folio_and_swap_cache() drops that final reference, the page enters the final folio_put() release path. In parallel, folio_isolate_lru() can observe the same tail page with a non-zero refcount and PG_lru set. It clears PG_lru before taking its own reference. If this races with the final folio_put() from the split path, __folio_put() sees PG_lru already cleared and skips lruvec_del_folio(). The page is then freed back to the allocator while its lru links are still present in the LRU list. A later LRU operation on a neighboring page detects the stale link and reports list corruption. [1] [ 22.486082] list_del corruption. next->prev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88) [ 22.486130] ------------[ cut here ]------------ [ 22.486134] kernel BUG at lib/list_debug.c:67! [ 22.486141] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE [ 22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT) [ 22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154 [ 22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154 [ 22.488539] sp : ffffffc08006b830 [ 22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000 [ 22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0 [ 22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122 [ 22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060 [ 22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058 [ 22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003 [ 22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00 [ 22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c [ 22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010 [ 22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d [ 22.488647] Call trace: [ 22.488651] __list_del_entry_valid_or_report+0x14c/0x154 (P) [ 22.488661] __folio_put+0x2bc/0x434 [ 22.488670] folio_put+0x28/0x58 [ 22.488678] do_garbage_collect+0x1a34/0x2584 [ 22.488689] f2fs_gc+0x230/0x9b4 [ 22.488697] f2fs_fallocate+0xb90/0xdf4 [ 22.488706] vfs_fallocate+0x1b4/0x2bc [ 22.488716] __arm64_sys_fallocate+0x44/0x78 [ 22.488725] invoke_syscall+0x58/0xe4 [ 22.488732] do_el0_svc+0x48/0xdc [ 22.488739] el0 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5a4d3968cf820686400fc757a4512dcaddd84846 , < 1991d49433e90b2202de2fe90be3c24161873d7c (git)
Affected: 9609dd704725a40cd63d915f2ab6c44248a44598 , < 6e035dae44154af4dd7bdb8ef7a1118c0b5f17b6 (git)
Affected: 9609dd704725a40cd63d915f2ab6c44248a44598 , < ccaba785821970f422c47770331c7e3271763f17 (git)
Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/gc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1991d49433e90b2202de2fe90be3c24161873d7c",
              "status": "affected",
              "version": "5a4d3968cf820686400fc757a4512dcaddd84846",
              "versionType": "git"
            },
            {
              "lessThan": "6e035dae44154af4dd7bdb8ef7a1118c0b5f17b6",
              "status": "affected",
              "version": "9609dd704725a40cd63d915f2ab6c44248a44598",
              "versionType": "git"
            },
            {
              "lessThan": "ccaba785821970f422c47770331c7e3271763f17",
              "status": "affected",
              "version": "9609dd704725a40cd63d915f2ab6c44248a44598",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/gc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"\n\nThis reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598.\n\nThe kernel panics are keeping to be reported especially when the f2fs\npartition get almost full. By investigation, we find that the reason is\none f2fs page got freed to buddy without being deleted from LRU and the\nroot cause is the race happened in [2] which is enrolled by this commit.\n\nThere are 3 race processes in this scenario, please find below for their\nmain activities.\n\nThe changed code in move_data_block() lets the GC path evict the tail-end\nfolio from the page cache through folio_end_dropbehind().  Once\nfolio_unmap_invalidate() removes the folio from mapping-\u003ei_pages, the\npage-cache references for all pages in the folio are dropped.  The folio\nis then kept alive only by temporary external references, which allows a\nlater split to operate on a folio whose subpages are no longer protected\nby page-cache references.\n\nAfter the page-cache references are gone, split_folio_to_order() can\nsplit the big folio into individual pages and put the resulting subpages\nback on the LRU.  For tail pages beyond EOF, split removes them from the\npage cache and drops their page-cache references.  A tail page can then\nremain on the LRU with PG_lru set while holding only the split caller\u0027s\ntemporary reference.  When free_folio_and_swap_cache() drops that final\nreference, the page enters the final folio_put() release path.\n\nIn parallel, folio_isolate_lru() can observe the same tail page with a\nnon-zero refcount and PG_lru set.  It clears PG_lru before taking its own\nreference.  If this races with the final folio_put() from the split path,\n__folio_put() sees PG_lru already cleared and skips lruvec_del_folio().\nThe page is then freed back to the allocator while its lru links are\nstill present in the LRU list.  A later LRU operation on a neighboring\npage detects the stale link and reports list corruption.\n\n[1]\n[   22.486082] list_del corruption. next-\u003eprev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88)\n[   22.486130] ------------[ cut here ]------------\n[   22.486134] kernel BUG at lib/list_debug.c:67!\n[   22.486141] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[   22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE\n[   22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT)\n[   22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154\n[   22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154\n[   22.488539] sp : ffffffc08006b830\n[   22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000\n[   22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0\n[   22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122\n[   22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060\n[   22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058\n[   22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003\n[   22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00\n[   22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c\n[   22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010\n[   22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d\n[   22.488647] Call trace:\n[   22.488651]  __list_del_entry_valid_or_report+0x14c/0x154 (P)\n[   22.488661]  __folio_put+0x2bc/0x434\n[   22.488670]  folio_put+0x28/0x58\n[   22.488678]  do_garbage_collect+0x1a34/0x2584\n[   22.488689]  f2fs_gc+0x230/0x9b4\n[   22.488697]  f2fs_fallocate+0xb90/0xdf4\n[   22.488706]  vfs_fallocate+0x1b4/0x2bc\n[   22.488716]  __arm64_sys_fallocate+0x44/0x78\n[   22.488725]  invoke_syscall+0x58/0xe4\n[   22.488732]  do_el0_svc+0x48/0xdc\n[   22.488739]  el0\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local filesystem operations on F2FS\u2014primarily the fallocate syscall (as in the reported oops: vfs_fallocate \u2192 f2fs_fallocate \u2192 f2fs_gc \u2192 do_garbage_collect \u2192 move_data_block). F2FS is the default on Android and many embedded devices, but the attack path is local syscalls, not a network protocol.\nAC:L - The three-way race between GC (move_data_block/folio_end_dropbehind), split_folio_to_order, and folio_isolate_lru is attacker-influenceable: an unprivileged user can fill the partition to force foreground GC, generate concurrent I/O and memory pressure to drive reclaim, and run parallel threads to race the vulnerable paths.\nPR:L - Triggering GC via fallocate or other file operations requires only standard write access to files on an F2FS mount, not real root or CAP_SYS_ADMIN (that capability is only needed for the optional F2FS GC ioctl). On Android and similar systems, apps routinely have write access to encrypted F2FS-backed data that uses the move_data_block GC path.\nUI:N - Exploitation requires no action by another user or administrator beyond the attacker invoking filesystem syscalls on storage they can already write to; no social engineering or victim-driven steps are involved.\nS:U - The vulnerability corrupts kernel page-cache/LRU state and can panic the kernel, but it does not cross a security boundary such as a VM guest-to-host escape or sandbox breakout\u2014the impact remains within the compromised kernel\u0027s authority.\nC:H - The race frees a page back to the buddy allocator while its LRU list entry remains linked, producing a classic use-after-free; the crash log shows LIST_POISON (dead000000000122) on corrupted list pointers, and UAF of page structures can enable arbitrary kernel memory disclosure.\nI:H - Freeing a page that is still referenced from the LRU list is heap memory corruption; UAF of page-cache folios is exploitable for controlled reuse and potential arbitrary write or control-flow hijacking, not merely a benign crash.\nA:H - The failure mode is a kernel BUG/Oops from list_del corruption in __folio_put during GC, causing kernel panic as demonstrated on production Android hardware (Spreadtrum UMS9230) when the F2FS partition is nearly full."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:59.297Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1991d49433e90b2202de2fe90be3c24161873d7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e035dae44154af4dd7bdb8ef7a1118c0b5f17b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccaba785821970f422c47770331c7e3271763f17"
        }
      ],
      "title": "Revert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63813",
    "datePublished": "2026-07-19T12:02:14.205Z",
    "dateReserved": "2026-07-19T07:54:57.013Z",
    "dateUpdated": "2026-08-05T12:35:59.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63813",
      "date": "2026-08-11",
      "epss": "0.00119",
      "percentile": "0.02054"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63813\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T12:16:54.253\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"f2fs: remove non-uptodate folio from the page cache in move_data_block\\\"\\n\\nThis reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598.\\n\\nThe kernel panics are keeping to be reported especially when the f2fs\\npartition get almost full. By investigation, we find that the reason is\\none f2fs page got freed to buddy without being deleted from LRU and the\\nroot cause is the race happened in [2] which is enrolled by this commit.\\n\\nThere are 3 race processes in this scenario, please find below for their\\nmain activities.\\n\\nThe changed code in move_data_block() lets the GC path evict the tail-end\\nfolio from the page cache through folio_end_dropbehind().  Once\\nfolio_unmap_invalidate() removes the folio from mapping-\u003ei_pages, the\\npage-cache references for all pages in the folio are dropped.  The folio\\nis then kept alive only by temporary external references, which allows a\\nlater split to operate on a folio whose subpages are no longer protected\\nby page-cache references.\\n\\nAfter the page-cache references are gone, split_folio_to_order() can\\nsplit the big folio into individual pages and put the resulting subpages\\nback on the LRU.  For tail pages beyond EOF, split removes them from the\\npage cache and drops their page-cache references.  A tail page can then\\nremain on the LRU with PG_lru set while holding only the split caller\u0027s\\ntemporary reference.  When free_folio_and_swap_cache() drops that final\\nreference, the page enters the final folio_put() release path.\\n\\nIn parallel, folio_isolate_lru() can observe the same tail page with a\\nnon-zero refcount and PG_lru set.  It clears PG_lru before taking its own\\nreference.  If this races with the final folio_put() from the split path,\\n__folio_put() sees PG_lru already cleared and skips lruvec_del_folio().\\nThe page is then freed back to the allocator while its lru links are\\nstill present in the LRU list.  A later LRU operation on a neighboring\\npage detects the stale link and reports list corruption.\\n\\n[1]\\n[   22.486082] list_del corruption. next-\u003eprev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88)\\n[   22.486130] ------------[ cut here ]------------\\n[   22.486134] kernel BUG at lib/list_debug.c:67!\\n[   22.486141] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\\n[   22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE\\n[   22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT)\\n[   22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n[   22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154\\n[   22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154\\n[   22.488539] sp : ffffffc08006b830\\n[   22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000\\n[   22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0\\n[   22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122\\n[   22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060\\n[   22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058\\n[   22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003\\n[   22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00\\n[   22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c\\n[   22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010\\n[   22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d\\n[   22.488647] Call trace:\\n[   22.488651]  __list_del_entry_valid_or_report+0x14c/0x154 (P)\\n[   22.488661]  __folio_put+0x2bc/0x434\\n[   22.488670]  folio_put+0x28/0x58\\n[   22.488678]  do_garbage_collect+0x1a34/0x2584\\n[   22.488689]  f2fs_gc+0x230/0x9b4\\n[   22.488697]  f2fs_fallocate+0xb90/0xdf4\\n[   22.488706]  vfs_fallocate+0x1b4/0x2bc\\n[   22.488716]  __arm64_sys_fallocate+0x44/0x78\\n[   22.488725]  invoke_syscall+0x58/0xe4\\n[   22.488732]  do_el0_svc+0x48/0xdc\\n[   22.488739]  el0\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/gc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5a4d3968cf820686400fc757a4512dcaddd84846\",\"lessThan\":\"1991d49433e90b2202de2fe90be3c24161873d7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9609dd704725a40cd63d915f2ab6c44248a44598\",\"lessThan\":\"6e035dae44154af4dd7bdb8ef7a1118c0b5f17b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9609dd704725a40cd63d915f2ab6c44248a44598\",\"lessThan\":\"ccaba785821970f422c47770331c7e3271763f17\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/gc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1991d49433e90b2202de2fe90be3c24161873d7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e035dae44154af4dd7bdb8ef7a1118c0b5f17b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ccaba785821970f422c47770331c7e3271763f17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-05T14:05:46+00:00",
      "cve": "CVE-2026-63813",
      "id": "CVE-2026-63813",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63813.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:11:28Z",
      "cve": "CVE-2026-63813",
      "id": "CVE-2026-63813",
      "initial_release_date": "2026-07-19T17:34:52Z",
      "product_status:known_not_affected": "286",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63813",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63813.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.