CVE Explorer

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally: if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size); but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline de

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ea08f039393cee0491ea63189482e40cff56c77aeeb8cd702577609f706ecd6f

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqu…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3c8d6b4093aea40a20596f452289e7c22d84e6d5","status":"affected","version":"6afc662e68b5f988282ff20afd58a89b1c279dca","versionType":"git"},{"lessThan":"a08ee30dcbeff6b97df75c38c2589603ddde53a6","status":"affected","version":"6afc662e68b5f988282ff20afd58a89b1c279dca","versionType":"git"},{"lessThan":"c3e05522daae4e7348a1ea81eeb321d25aa0fd3b","status":"affected","version":"6afc662e68b5f988282ff20afd58a8…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:1e9d08ec46ce779c1ae26b3cf7059765f8f605f5533ce9f737a32ca4844b0c0a · sha256:41129c99dfe7633b… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer