CVE-2026-93816 (GCVE-0-2026-93816)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:02 – Updated: 2026-09-25 12:43
VLAI
Title
f2fs: validate inline dentry name lengths before conversion
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry name lengths before conversion Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block. Validate each inline dentry name length against the inline filename area before copying it.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e , < 2ce0bc5853bec7cdc724477a87ea579fde664243 (git)
Affected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e , < 7caa8a0ae94b132576c2e46e9b4fd4e0f356f373 (git)
Affected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e , < cfcd0e49a178b3dac2c0ece656079081dbf5da74 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ce0bc5853bec7cdc724477a87ea579fde664243",
              "status": "affected",
              "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
              "versionType": "git"
            },
            {
              "lessThan": "7caa8a0ae94b132576c2e46e9b4fd4e0f356f373",
              "status": "affected",
              "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
              "versionType": "git"
            },
            {
              "lessThan": "cfcd0e49a178b3dac2c0ece656079081dbf5da74",
              "status": "affected",
              "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The oversized de-\u003ename_len is on-disk in the directory inode\u0027s inline dentry, not in a network PDU. creat/mkdir/rename reach the patched f2fs_add_inline_entries via f2fs_add_link\u2192f2fs_add_inline_entry\u2192do_convert_inline_dir\u2192f2fs_move_rehashed_dirents (or f2fs_try_convert_inline_dir on same-dir rename); the syscall only supplies a normal filename that forces conversion.\nAC:L - The image sets i_dir_level nonzero (do_read_inode copies ri-\u003ei_dir_level with no range check, so conversion uses f2fs_move_rehashed_dirents), fills the inline bitmap so f2fs_room_for_filename fails, and plants a name_len that overruns remaining filename slots. The next creat(2) or recover_dentry add then hits the memcpy with no race.\nPR:N - Crafting the f2fs image takes no account or capability on the target. f2fs_add_inline_entries has no capable() gate; init-namespace CAP_SYS_ADMIN (f2fs_fs_type lacks FS_USERNS_MOUNT) is the victim\u0027s or automount helper\u0027s mount privilege, not the attacker\u0027s.\nUI:R - The bad name_len is only consumed after that image is mounted. A victim or trusted helper (udisks/vold) must mount it before f2fs_create/f2fs_rename or roll-forward recover_dentry\u2192f2fs_add_dentry can call f2fs_add_inline_entries; automount does not make this a network bug.\nS:U - f2fs_update_dentry\u0027s over-read from backup_dentry and any oops stay in the host kernel that mounted the volume. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - f2fs_add_inline_entries sets fname.disk_name.len from unvalidated de-\u003ename_len and f2fs_update_dentry memcpy\u0027s that many bytes from the kmalloc\u0027d backup_dentry filename array. A name_len that still fits a regular dentry block (GET_DENTRY_SLOTS\u003c=NR_DENTRY_IN_BLOCK, up to 1705) reads past MAX_INLINE_DATA into adjacent slab; those bytes become the converted name.\nI:N - f2fs_add_regular_entry only calls f2fs_update_dentry after f2fs_room_for_filename finds GET_DENTRY_SLOTS(name_len) free dest slots, so the memcpy stays inside the new 4K dentry folio. There is no kernel OOB write, UAF, or control-flow hijack; treating any heap over-read as I:H would apply to every infoleak.\nA:H - The same memcpy over-reads f2fs_kmalloc(MAX_INLINE_DATA) (~3KB) by up to ~1700 bytes, which can leave the slab object and oops on unmapped/poisoned memory during conversion, panicking or killing the task. A name_len whose slot count exceeds NR_DENTRY_IN_BLOCK also walks MAX_DIR_HASH_DEPTH allocating empty dir blocks before -ENOSPC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:43:24.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ce0bc5853bec7cdc724477a87ea579fde664243"
        },
        {
          "url": "https://git.kernel.org/stable/c/7caa8a0ae94b132576c2e46e9b4fd4e0f356f373"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfcd0e49a178b3dac2c0ece656079081dbf5da74"
        }
      ],
      "title": "f2fs: validate inline dentry name lengths before conversion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93816",
    "datePublished": "2026-09-24T16:02:53.171Z",
    "dateReserved": "2026-09-18T17:59:28.791Z",
    "dateUpdated": "2026-09-25T12:43:24.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93816",
      "date": "2026-09-25",
      "epss": "0.0013",
      "percentile": "0.02145"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/inline.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2ce0bc5853bec7cdc724477a87ea579fde664243",
                    "status": "affected",
                    "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7caa8a0ae94b132576c2e46e9b4fd4e0f356f373",
                    "status": "affected",
                    "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cfcd0e49a178b3dac2c0ece656079081dbf5da74",
                    "status": "affected",
                    "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/inline.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it."
          }
        ],
        "id": "CVE-2026-93816",
        "lastModified": "2026-09-25T13:17:22.463",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:15.120",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2ce0bc5853bec7cdc724477a87ea579fde664243"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7caa8a0ae94b132576c2e46e9b4fd4e0f356f373"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cfcd0e49a178b3dac2c0ece656079081dbf5da74"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.