Vulnerability-Lookup

GHSA-G6G4-C2JH-P7HG

Vulnerability from github – Published: 2026-09-24 18:31 – Updated: 2026-09-25 06:30

Details

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate inline dentry name lengths before conversion

Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots.

A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block.

Validate each inline dentry name length against the inline filename area before copying it.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-93816"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-24T17:17:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it.",
  "id": "GHSA-g6g4-c2jh-p7hg",
  "modified": "2026-09-25T06:30:30Z",
  "published": "2026-09-24T18:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93816"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2ce0bc5853bec7cdc724477a87ea579fde664243"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7caa8a0ae94b132576c2e46e9b4fd4e0f356f373"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cfcd0e49a178b3dac2c0ece656079081dbf5da74"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-93816 (GCVE-0-2026-93816)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:02 – Updated: 2026-09-25 12:43

Title

f2fs: validate inline dentry name lengths before conversion

Summary

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry name lengths before conversion Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block. Validate each inline dentry name length against the inline filename area before copying it.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/2ce0bc5853bec7cdc…
https://git.kernel.org/stable/c/7caa8a0ae94b13257…
https://git.kernel.org/stable/c/cfcd0e49a178b3dac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e , < 2ce0bc5853bec7cdc724477a87ea579fde664243 (git) Affected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e , < 7caa8a0ae94b132576c2e46e9b4fd4e0f356f373 (git) Affected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e , < cfcd0e49a178b3dac2c0ece656079081dbf5da74 (git)
Linux	Linux	Affected: 4.7 Unaffected: 0 , < 4.7 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ce0bc5853bec7cdc724477a87ea579fde664243",
              "status": "affected",
              "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
              "versionType": "git"
            },
            {
              "lessThan": "7caa8a0ae94b132576c2e46e9b4fd4e0f356f373",
              "status": "affected",
              "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
              "versionType": "git"
            },
            {
              "lessThan": "cfcd0e49a178b3dac2c0ece656079081dbf5da74",
              "status": "affected",
              "version": "675f10bde6cc3874632a8f684df2a8a2a8ace76e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The oversized de-\u003ename_len is on-disk in the directory inode\u0027s inline dentry, not in a network PDU. creat/mkdir/rename reach the patched f2fs_add_inline_entries via f2fs_add_link\u2192f2fs_add_inline_entry\u2192do_convert_inline_dir\u2192f2fs_move_rehashed_dirents (or f2fs_try_convert_inline_dir on same-dir rename); the syscall only supplies a normal filename that forces conversion.\nAC:L - The image sets i_dir_level nonzero (do_read_inode copies ri-\u003ei_dir_level with no range check, so conversion uses f2fs_move_rehashed_dirents), fills the inline bitmap so f2fs_room_for_filename fails, and plants a name_len that overruns remaining filename slots. The next creat(2) or recover_dentry add then hits the memcpy with no race.\nPR:N - Crafting the f2fs image takes no account or capability on the target. f2fs_add_inline_entries has no capable() gate; init-namespace CAP_SYS_ADMIN (f2fs_fs_type lacks FS_USERNS_MOUNT) is the victim\u0027s or automount helper\u0027s mount privilege, not the attacker\u0027s.\nUI:R - The bad name_len is only consumed after that image is mounted. A victim or trusted helper (udisks/vold) must mount it before f2fs_create/f2fs_rename or roll-forward recover_dentry\u2192f2fs_add_dentry can call f2fs_add_inline_entries; automount does not make this a network bug.\nS:U - f2fs_update_dentry\u0027s over-read from backup_dentry and any oops stay in the host kernel that mounted the volume. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - f2fs_add_inline_entries sets fname.disk_name.len from unvalidated de-\u003ename_len and f2fs_update_dentry memcpy\u0027s that many bytes from the kmalloc\u0027d backup_dentry filename array. A name_len that still fits a regular dentry block (GET_DENTRY_SLOTS\u003c=NR_DENTRY_IN_BLOCK, up to 1705) reads past MAX_INLINE_DATA into adjacent slab; those bytes become the converted name.\nI:N - f2fs_add_regular_entry only calls f2fs_update_dentry after f2fs_room_for_filename finds GET_DENTRY_SLOTS(name_len) free dest slots, so the memcpy stays inside the new 4K dentry folio. There is no kernel OOB write, UAF, or control-flow hijack; treating any heap over-read as I:H would apply to every infoleak.\nA:H - The same memcpy over-reads f2fs_kmalloc(MAX_INLINE_DATA) (~3KB) by up to ~1700 bytes, which can leave the slab object and oops on unmapped/poisoned memory during conversion, panicking or killing the task. A name_len whose slot count exceeds NR_DENTRY_IN_BLOCK also walks MAX_DIR_HASH_DEPTH allocating empty dir blocks before -ENOSPC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:43:24.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ce0bc5853bec7cdc724477a87ea579fde664243"
        },
        {
          "url": "https://git.kernel.org/stable/c/7caa8a0ae94b132576c2e46e9b4fd4e0f356f373"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfcd0e49a178b3dac2c0ece656079081dbf5da74"
        }
      ],
      "title": "f2fs: validate inline dentry name lengths before conversion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93816",
    "datePublished": "2026-09-24T16:02:53.171Z",
    "dateReserved": "2026-09-18T17:59:28.791Z",
    "dateUpdated": "2026-09-25T12:43:24.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-G6G4-C2JH-P7HG

CVE-2026-93816 (GCVE-0-2026-93816)

Tags

Sightings

Nomenclature

Related by attack behaviour