01 Record

CVE-2026-63812

f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.12% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 1.9% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Awaiting Analysis. NVD last modified this record on 2026-08-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-19 12:02Z3 MO AGO

Last updated

2026-08-17 04:51Z2 MO AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-821Incorrect SynchronizationBase

Data version

5.2

Document digest

84e1540aefa48c3d81b0e141a31d42a50c429b2c3ae505c7f691966c781d939d

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux42dd1c91f993431d0b399502479d00e6ad1bca71 to < 7e4d8f98be63f98856a5176b9188dada6e7ba9ee, ab1eaf9d5c99042f5b0243bf67a06283a4c0757f to < 58a5deb220bcac4c73bf58954c0845644c997487, b0e4395870eb3441ddc959f6710b5f6ca61aff26 to < 20190e498057997532c7f186d081011f18e0a462, ed78aeebef05212ef7dca93bd931e4eff67c113f to < edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7, ed78aeebef05212ef7dca93bd931e4eff67c113f to < 1f70ddb28a3c71df124da5fa4040c808116d6bb9, 0559a0e962aacbb47519e26ee663be04b72dcb92, 6.6.140 to < 6.6.144, 6.12.88 to < 6.12.95, 6.18.30 to < 6.18.38, 7.0.7 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee
git.kernel.orghttps://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487
git.kernel.orghttps://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462
git.kernel.orghttps://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7
git.kernel.orghttps://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9

07 Fixed in

Debian 13

linux
Fixed in 6.12.95-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.