{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.3-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on f2fs_get_node_folio_ra()  kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845 Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 \u003c0f\u003e 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90 RSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283 RAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000 RDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504 RBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002 R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c FS:  00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff0305c4000 CR3: 0000000012d4c000 CR4: 0000000000352ef0 Call Trace:  \u003cTASK\u003e  f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:882  f2fs_truncate+0x471/0x7c0 fs/f2fs/file.c:940  f2fs_evict_inode+0xa3f/0x1ac0 fs/f2fs/inode.c:907  evict+0x61e/0xb10 fs/inode.c:841  f2fs_fill_super+0x5f43/0x78f0 fs/f2fs/super.c:5224  get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694  vfs_get_tree+0x92/0x2a0 fs/super.c:1754  fc_mount fs/namespace.c:1193 [inline]  do_new_mount_fc fs/namespace.c:3758 [inline]  do_new_mount+0x341/0xd30 fs/namespace.c:3834  do_mount fs/namespace.c:4167 [inline]  __do_sys_mount fs/namespace.c:4383 [inline]  __se_sys_mount+0x31d/0x420 fs/namespace.c:4360  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x77/0x7f  \tcount = ADDRS_PER_PAGE(dn.node_folio, inode);  \tcount -= dn.ofs_in_node; \tf2fs_bug_on(sbi, count \u003c 0);  The fuzz test will trigger above bug_on in f2fs.  The root cause should be: in the corrupted inode, there is a direct node which has the same ino and nid in its footer, so in f2fs_do_truncate_blocks(), after f2fs_get_dnode_of_data() finds such dnode: 1) ADDRS_PER_PAGE(dn.node_folio, inode) will return 923 2) once dn.ofs_in_node points to addr[923, 1017] Then it will trigger the system panic.  Let's introduce NODE_TYPE_NON_IXNODE to indicate current node should not be an inode or xattr node, and then use it in below path to detect inconsistent node chain in inode mapping table:  - f2fs_do_truncate_blocks  - f2fs_get_dnode_of_data   - f2fs_get_node_folio_ra    -  __get_node_folio     - f2fs_sanity_check_node_footer      - case NODE_TYPE_NON_IXNODE -\u003e check whether it is inode|xnode",
  "id": "DEBIAN-CVE-2026-63819",
  "modified": "2026-09-14T16:47:36.295202255Z",
  "published": "2026-07-19T12:16:54.980Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-63819"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-63819"
  ]
}