CyberSecBulletin
CVE-2026-63815NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-63815 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.4 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists versions 3c8d6b4093aea40a20596f452289e7c22d84e6d5, a08ee30dcbeff6b97df75c38c2589603ddde53a6, c3e05522daae4e7348a1ea81eeb321d25aa0fd3b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 3c8d6b4093aea40a20596f452289e7c22d84e6d5 or a08ee30dcbeff6b97df75c38c2589603ddde53a6 or c3e05522daae4e7348a1ea81eeb321d25aa0fd3b or 76e1a05cf6d4051931d7fa4ead51a05786a62918, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, 3c8d6b4093aea40a20596f452289e7c22d84e6d5; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, a08ee30dcbeff6b97df75c38c2589603ddde53a6; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, c3e05522daae4e7348a1ea81eeb321d25aa0fd3b; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, 76e1a05cf6d4051931d7fa4ead51a05786a62918; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, 2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, 4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, 16bc237ce3c483b75575abea53cfb639745311ed; 6afc662e68b5f988282ff20afd58a89b1c279dca up to, but not including, 378acf3cf19b6af6cba55e8dd1154c4e1504bae8; and 1 more ranges3c8d6b4093aea40a20596f452289e7c22d84e6d5, a08ee30dcbeff6b97df75c38c2589603ddde53a6, c3e05522daae4e7348a1ea81eeb321d25aa0fd3b, 76e1a05cf6d4051931d7fa4ead51a05786a62918, 2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706, 4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d
LinuxLinux Kernel4.15 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.35.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally: if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size); but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image. get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry: MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...) addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area: while (bit_pos < d->max) /* fs/f2fs/dir.c */ ... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ... Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files. Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.