{"id":14889,"date":"2026-09-04T19:02:16","date_gmt":"2026-09-04T11:02:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63814"},"modified":"2026-09-04T19:02:16","modified_gmt":"2026-09-04T11:02:16","slug":"cve-2026-63814","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63814","title":{"rendered":"CVE-2026-63814 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate ACL en"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>f2fs: validate ACL entry sizes in f2fs_acl_from_disk()<\/p>\n<p>f2fs_acl_count() only validates the aggregate ACL xattr length. A<br \/>\nmalformed ACL can still place ACL_USER or ACL_GROUP in a slot that only<br \/>\ncontains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk()<br \/>\nthen reads entry-&gt;e_id before verifying that a full entry fits.<\/p>\n<p>Require a short entry before reading e_tag and e_perm, and require a<br \/>\nfull entry before reading e_id for ACL_USER and ACL_GROUP. Return<br \/>\n-EFSCORRUPTED from these new truncated-entry checks, while keeping the<br \/>\npre-existing -EINVAL paths unchanged.<\/p>\n<p>Validation reproduced this kernel report:<br \/>\nKASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb\/0x7e0<br \/>\nRIP: 0033:0x7f4b835ea7aa<br \/>\nThe buggy address belongs to the object at ffff888114589960 which belongs<br \/>\nto the cache kmalloc-8 of size 8<br \/>\nThe buggy address is located 0 bytes to the right of allocated 8-byte<br \/>\nregion [ffff888114589960, ffff888114589968)<br \/>\nRead of size 4<br \/>\nCall trace:<br \/>\n  dump_stack_lvl+0x66\/0xa0 (?:?)<br \/>\n  print_report+0xce\/0x630 (?:?)<br \/>\n  __f2fs_get_acl+0x6fb\/0x7e0 (fs\/f2fs\/acl.c:169)<br \/>\n  srso_alias_return_thunk+0x5\/0xfbef5 (?:?)<br \/>\n  __virt_addr_valid+0x224\/0x430 (?:?)<br \/>\n  kasan_report+0xe0\/0x110 (?:?)<br \/>\n  __f2fs_get_acl+0x5\/0x7e0 (fs\/f2fs\/acl.c:169)<br \/>\n  __get_acl+0x281\/0x380 (?:?)<br \/>\n  vfs_get_acl+0x10b\/0x190 (?:?)<br \/>\n  do_get_acl+0x2a\/0x410 (?:?)<br \/>\n  do_get_acl+0x9\/0x410 (?:?)<br \/>\n  do_getxattr+0xe8\/0x260 (?:?)<br \/>\n  filename_getxattr+0xd1\/0x140 (?:?)<br \/>\n  do_getname+0x2d\/0x2d0 (?:?)<br \/>\n  path_getxattrat+0x16c\/0x200 (?:?)<br \/>\n  lock_release+0xc8\/0x290 (?:?)<br \/>\n  cgroup_update_frozen+0x9d\/0x320 (?:?)<br \/>\n  lockdep_hardirqs_on_prepare+0xea\/0x1a0 (?:?)<br \/>\n  trace_hardirqs_on+0x1a\/0x170 (?:?)<br \/>\n  _raw_spin_unlock_irq+0x28\/0x50 (?:?)<br \/>\n  do_syscall_64+0x115\/0x6a0 (arch\/x86\/entry\/syscall_64.c:87)<br \/>\n  entry_SYSCALL_64_after_hwframe+0x77\/0x7f (?:?)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>f2fs: validate ACL entry sizes in f2fs_acl_from_disk()<\/p>\n<p>f2fs_acl_count() only validates the aggregate ACL xattr length. A<br \/>\nmalformed<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14889","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}