f2fs: read COW data with the original inode during atomic write
In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fs_write_begin() may read the previously written data back from the COW inode: prepare_atomic_write_begin() locates the block in the COW inode and sets use_cow, and the read bio is then built with the COW inode: f2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode, ...); and f2fs_grab_read_bio() decides whether to schedule fs-layer decryption (STEP_DECRYPT) for the bio based on that inode via fscrypt_inode_uses_fs_layer_crypto(). However, the folio being filled belongs to the original inode (folio->mapping->host == inode), and the data stored in the COW block was encrypted (or left as plaintext) using the original inode's context, not the COW inode's -- see f2fs_encrypt_one_page(), which keys off fio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise operates on folio->mapping->host. The COW inode is created as a tmpfile in the parent directory and inherits its encryption policy from there. With test_dummy_encryption the newly created COW inode gets the dummy policy and becomes encrypted, while a pre-existing regular file -- created before the policy applied, e.g. already present in the on-disk image -- stays unencrypted. The read path then sets STEP_DECRYPT based on the encrypted COW inode and calls fscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted original
CVE-2026-63811
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63811
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"lessThan": "bcc9df992f3cbc43f2ecfe0b22e428e50f326e72",
"versionType": "git"
},
{
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"lessThan": "655d55c5740d37ffdf6233ff5fe21cea879407f1",
"versionType": "git"
},
{
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"lessThan": "7e4ab3907f44dc243d026048d7f5d477dae9267b",
"versionType": "git"
},
{
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"lessThan": "a92332f32a8d31a7eee47b1dc1d751cb3319908f",
"versionType": "git"
},
{
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"lessThan": "a41075acde0124d2f8a5f563068a5d63e8ffd57b",
"versionType": "git"
}
],
"programFiles": [
"fs/f2fs/data.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/f2fs/data.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-63811
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46398 · Revision 1
- Added to Heist Feed
- Publisher date