CVE-2026-63816

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires local access through filesystem syscalls and ioctls (atomic-write ioctls, file I/O, close/evict) on an F2FS mount; there is no network-facing entry point to the vulnerable GC path.

AC:LAttack complexity, low

The attacker controls both sides of the race by running concurrent threads that perform atomic writes/commits/closes while filling the filesystem or driving writes to trigger background or foreground GC via f2fs_balance_fs and the f2fs_gc kthread.

PR:LPrivileges required, low

No real root is required; an unprivileged local user with write access to their own files on F2FS can use atomic-write ioctls and normal I/O to reach the bug, while GC runs automatically without CAP_SYS_ADMIN.

UI:NUser interaction, none

The attacker can trigger the full exploit chain on files they own without any separate victim user performing actions; atomic-write setup, GC pressure, and inode eviction are all orchestrated by the attacker process.

S:UScope, unchanged

Impact is kernel memory corruption and potential local privilege escalation within the same kernel security boundary, not a cross-VM or cross-container escape to a different security authority.

C:HConfidentiality impact, high

This is a use-after-free on a live inode address_space; the freed atomic_inode can be reused or read through stale mapping pointers, enabling arbitrary kernel memory disclosure primitives.

I:HIntegrity impact, high

UAF on inode mapping during folio allocation allows heap corruption and control of freed object contents, which is exploitable for arbitrary kernel write and local privilege escalation.

A:HAvailability impact, high

The race reliably leads to kernel BUG_ON in clear_inode when nrpages is nonzero, and UAF corruption can cause kernel oops or panic even before full exploitation.