CVE-2026-63814 (GCVE-0-2026-63814)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-05 12:36
VLAI
Title
f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fs_acl_from_disk() f2fs_acl_count() only validates the aggregate ACL xattr length. A malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk() then reads entry->e_id before verifying that a full entry fits. Require a short entry before reading e_tag and e_perm, and require a full entry before reading e_id for ACL_USER and ACL_GROUP. Return -EFSCORRUPTED from these new truncated-entry checks, while keeping the pre-existing -EINVAL paths unchanged. Validation reproduced this kernel report: KASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0 RIP: 0033:0x7f4b835ea7aa The buggy address belongs to the object at ffff888114589960 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888114589960, ffff888114589968) Read of size 4 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x224/0x430 (?:?) kasan_report+0xe0/0x110 (?:?) __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169) __get_acl+0x281/0x380 (?:?) vfs_get_acl+0x10b/0x190 (?:?) do_get_acl+0x2a/0x410 (?:?) do_get_acl+0x9/0x410 (?:?) do_getxattr+0xe8/0x260 (?:?) filename_getxattr+0xd1/0x140 (?:?) do_getname+0x2d/0x2d0 (?:?) path_getxattrat+0x16c/0x200 (?:?) lock_release+0xc8/0x290 (?:?) cgroup_update_frozen+0x9d/0x320 (?:?) lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?) trace_hardirqs_on+0x1a/0x170 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < 733cd8474e6d763d75ed96f3f2b98a25480cf2b9 (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < 4e2a96ec7236e248e706850568e0a925fd21b588 (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < 442ca20c54038e2400cf28aaa944cf1de2c8e65d (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < 1ddf3fd21c4c652f9cab5552515c04a166662306 (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1 (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < ff83de56882cb8466184d322abece2589258ca56 (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < 5d8a39649947a4e86c8fbc682d7fc0041b8d109a (git)
Affected: af48b85b8cd3fbb12c9b6759c16db6d69c0b03da , < c4810ada31e80cbe4011467c4f3b1e93f94134f3 (git)
Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 5.10.260 , ≤ 5.10.* (semver)
Unaffected: 5.15.211 , ≤ 5.15.* (semver)
Unaffected: 6.1.177 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "733cd8474e6d763d75ed96f3f2b98a25480cf2b9",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "4e2a96ec7236e248e706850568e0a925fd21b588",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "442ca20c54038e2400cf28aaa944cf1de2c8e65d",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "1ddf3fd21c4c652f9cab5552515c04a166662306",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "ff83de56882cb8466184d322abece2589258ca56",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "5d8a39649947a4e86c8fbc682d7fc0041b8d109a",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "c4810ada31e80cbe4011467c4f3b1e93f94134f3",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate ACL entry sizes in f2fs_acl_from_disk()\n\nf2fs_acl_count() only validates the aggregate ACL xattr length. A\nmalformed ACL can still place ACL_USER or ACL_GROUP in a slot that only\ncontains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk()\nthen reads entry-\u003ee_id before verifying that a full entry fits.\n\nRequire a short entry before reading e_tag and e_perm, and require a\nfull entry before reading e_id for ACL_USER and ACL_GROUP. Return\n-EFSCORRUPTED from these new truncated-entry checks, while keeping the\npre-existing -EINVAL paths unchanged.\n\nValidation reproduced this kernel report:\nKASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0\nRIP: 0033:0x7f4b835ea7aa\nThe buggy address belongs to the object at ffff888114589960 which belongs\nto the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes to the right of allocated 8-byte\nregion [ffff888114589960, ffff888114589968)\nRead of size 4\nCall trace:\n  dump_stack_lvl+0x66/0xa0 (?:?)\n  print_report+0xce/0x630 (?:?)\n  __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169)\n  srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n  __virt_addr_valid+0x224/0x430 (?:?)\n  kasan_report+0xe0/0x110 (?:?)\n  __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169)\n  __get_acl+0x281/0x380 (?:?)\n  vfs_get_acl+0x10b/0x190 (?:?)\n  do_get_acl+0x2a/0x410 (?:?)\n  do_get_acl+0x9/0x410 (?:?)\n  do_getxattr+0xe8/0x260 (?:?)\n  filename_getxattr+0xd1/0x140 (?:?)\n  do_getname+0x2d/0x2d0 (?:?)\n  path_getxattrat+0x16c/0x200 (?:?)\n  lock_release+0xc8/0x290 (?:?)\n  cgroup_update_frozen+0x9d/0x320 (?:?)\n  lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?)\n  trace_hardirqs_on+0x1a/0x170 (?:?)\n  _raw_spin_unlock_irq+0x28/0x50 (?:?)\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local kernel entry points\u2014`getxattr`/`listxattr` syscalls (`path_getxattrat` \u2192 `do_getxattr` \u2192 `do_get_acl` \u2192 `vfs_get_acl` \u2192 `__get_acl` \u2192 `f2fs_get_acl` \u2192 `f2fs_acl_from_disk`), routine VFS permission checks (`check_acl` \u2192 `get_inode_acl`), and f2fs inode creation (`f2fs_init_acl` \u2192 `__f2fs_get_acl`). f2fs is overwhelmingly deployed as a local block filesystem (Android userdata, embedded flash); although nfsd/ksmbd also call `get_inode_acl`, that is a secondary path.\nAC:L - Once a malformed on-disk ACL xattr exists, triggering is deterministic\u2014the attacker fully controls the crafted ACL blob layout that passes `f2fs_acl_count()` but places `ACL_USER`/`ACL_GROUP` in a short-entry slot, causing a reliable 4-byte read past the allocated buffer. No races or victim-specific timing are required.\nPR:L - Normal `setxattr`/`setfacl` paths validate through `posix_acl_from_xattr` and write via `f2fs_acl_to_disk`, so planting the malformed on-disk format requires offline image crafting plus `CAP_SYS_ADMIN` (obtainable in an unprivileged user namespace) to loop-mount the image, or real root for raw block-device writes. Triggering only needs read access to the affected inode; `vfs_get_acl` performs no xattr permission check beyond LSM hooks.\nUI:N - In the highest-impact self-contained attack, the attacker crafts a malicious f2fs image and mounts it inside their own user namespace\u2014no victim interaction is required. A USB-delivery variant would need the victim to mount media, but that is not necessary for exploitation.\nS:U - The out-of-bounds read corrupts/leaks kernel heap memory within the same kernel security domain. This is a standard local kernel memory-safety flaw, not a cross-boundary escape (VM, container, or IOMMU).\nC:H - The vulnerability is a slab out-of-bounds read (`entry-\u003ee_id`, 4 bytes) past the kmalloc\u0027d ACL xattr buffer when a truncated `ACL_USER`/`ACL_GROUP` entry is parsed. This reads adjacent kernel heap objects and can disclose kernel pointers or other sensitive kernel data, satisfying the guidance for out-of-bounds kernel reads.\nI:H - Although the immediate fault is a read past bounds rather than a write, this is kernel heap memory corruption class behavior; adjacent-slab reads are routinely chained into further kernel exploitation (heap grooming, control of subsequent allocations) for arbitrary write and code execution. Per the scoring guidance to treat memory corruption bugs as enabling integrity compromise when uncertain, I:H is appropriate.\nA:H - The KASAN report confirms a slab-out-of-bounds access in `__f2fs_get_acl` during a syscall. The same path is hit on every permission-checked file access (`open`, `stat`, `exec`) and directory inode creation, so a malicious ACL on a widely accessed file can repeatedly fault the kernel or destabilize the system under memory hardening."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:00.414Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/733cd8474e6d763d75ed96f3f2b98a25480cf2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e2a96ec7236e248e706850568e0a925fd21b588"
        },
        {
          "url": "https://git.kernel.org/stable/c/442ca20c54038e2400cf28aaa944cf1de2c8e65d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ddf3fd21c4c652f9cab5552515c04a166662306"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff83de56882cb8466184d322abece2589258ca56"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d8a39649947a4e86c8fbc682d7fc0041b8d109a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4810ada31e80cbe4011467c4f3b1e93f94134f3"
        }
      ],
      "title": "f2fs: validate ACL entry sizes in f2fs_acl_from_disk()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63814",
    "datePublished": "2026-07-19T12:02:14.771Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:00.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63814",
      "date": "2026-08-11",
      "epss": "0.00127",
      "percentile": "0.02737"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-20T14:46:36.000Z",
      "cve": "CVE-2026-63814",
      "id": "msrc_CVE-2026-63814",
      "initial_release_date": "2026-07-20T01:07:45.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: validate ACL entry sizes in f2fs_acl_from_disk()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63814.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63814\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T12:16:54.390\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: validate ACL entry sizes in f2fs_acl_from_disk()\\n\\nf2fs_acl_count() only validates the aggregate ACL xattr length. A\\nmalformed ACL can still place ACL_USER or ACL_GROUP in a slot that only\\ncontains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk()\\nthen reads entry-\u003ee_id before verifying that a full entry fits.\\n\\nRequire a short entry before reading e_tag and e_perm, and require a\\nfull entry before reading e_id for ACL_USER and ACL_GROUP. Return\\n-EFSCORRUPTED from these new truncated-entry checks, while keeping the\\npre-existing -EINVAL paths unchanged.\\n\\nValidation reproduced this kernel report:\\nKASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0\\nRIP: 0033:0x7f4b835ea7aa\\nThe buggy address belongs to the object at ffff888114589960 which belongs\\nto the cache kmalloc-8 of size 8\\nThe buggy address is located 0 bytes to the right of allocated 8-byte\\nregion [ffff888114589960, ffff888114589968)\\nRead of size 4\\nCall trace:\\n  dump_stack_lvl+0x66/0xa0 (?:?)\\n  print_report+0xce/0x630 (?:?)\\n  __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169)\\n  srso_alias_return_thunk+0x5/0xfbef5 (?:?)\\n  __virt_addr_valid+0x224/0x430 (?:?)\\n  kasan_report+0xe0/0x110 (?:?)\\n  __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169)\\n  __get_acl+0x281/0x380 (?:?)\\n  vfs_get_acl+0x10b/0x190 (?:?)\\n  do_get_acl+0x2a/0x410 (?:?)\\n  do_get_acl+0x9/0x410 (?:?)\\n  do_getxattr+0xe8/0x260 (?:?)\\n  filename_getxattr+0xd1/0x140 (?:?)\\n  do_getname+0x2d/0x2d0 (?:?)\\n  path_getxattrat+0x16c/0x200 (?:?)\\n  lock_release+0xc8/0x290 (?:?)\\n  cgroup_update_frozen+0x9d/0x320 (?:?)\\n  lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?)\\n  trace_hardirqs_on+0x1a/0x170 (?:?)\\n  _raw_spin_unlock_irq+0x28/0x50 (?:?)\\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/acl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"733cd8474e6d763d75ed96f3f2b98a25480cf2b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"4e2a96ec7236e248e706850568e0a925fd21b588\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"442ca20c54038e2400cf28aaa944cf1de2c8e65d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"1ddf3fd21c4c652f9cab5552515c04a166662306\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"ff83de56882cb8466184d322abece2589258ca56\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"5d8a39649947a4e86c8fbc682d7fc0041b8d109a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af48b85b8cd3fbb12c9b6759c16db6d69c0b03da\",\"lessThan\":\"c4810ada31e80cbe4011467c4f3b1e93f94134f3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/acl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.260\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.211\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.177\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ddf3fd21c4c652f9cab5552515c04a166662306\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/442ca20c54038e2400cf28aaa944cf1de2c8e65d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4e2a96ec7236e248e706850568e0a925fd21b588\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5d8a39649947a4e86c8fbc682d7fc0041b8d109a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/733cd8474e6d763d75ed96f3f2b98a25480cf2b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c4810ada31e80cbe4011467c4f3b1e93f94134f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff83de56882cb8466184d322abece2589258ca56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:01:21+00:00",
      "cve": "CVE-2026-63814",
      "id": "CVE-2026-63814",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: validate ACL entry sizes in f2fs_acl_from_disk()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63814.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-21T23:48:00Z",
      "cve": "CVE-2026-63814",
      "id": "CVE-2026-63814",
      "initial_release_date": "2026-07-19T17:34:51Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63814",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63814.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.