All vulnerabilities
CVE-2026-93816

Linux: f2fs: validate inline dentry name lengths before conversion

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6b5552449fc5acb8e6ecf045b46702b29b71165aAlso 6343208fd73f3f2b8044c0922185cd13ff807693, 4dd81faa63fd54b9ba1a83c304e6d0bd03f1898d and 2 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 6b5552449fc5acb8e6ecf045b46702b29b71165aLinuxCVE List
  • 6343208fd73f3f2b8044c0922185cd13ff807693LinuxCVE List
  • 4dd81faa63fd54b9ba1a83c304e6d0bd03f1898dLinuxCVE List
  • 2ce0bc5853bec7cdc724477a87ea579fde664243LinuxCVE List
  • 7caa8a0ae94b132576c2e46e9b4fd4e0f356f373LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate inline dentry name lengths before conversion

Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots.

A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block.

Validate each inline dentry name length against the inline filename area before copying it.

Text from CVE List

Affected versions 16

  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before 6b5552449fc5acb8e6ecf045b46702b29b71165aCVE List
  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before 6343208fd73f3f2b8044c0922185cd13ff807693CVE List
  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before 4dd81faa63fd54b9ba1a83c304e6d0bd03f1898dCVE List
  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before aee4e6de71ca77626c006166ff00f1d01ff990c9CVE List
  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before 2ce0bc5853bec7cdc724477a87ea579fde664243CVE List
  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before 7caa8a0ae94b132576c2e46e9b4fd4e0f356f373CVE List
  • Linuxaffected: 675f10bde6cc3874632a8f684df2a8a2a8ace76e before cfcd0e49a178b3dac2c0ece656079081dbf5da74CVE List
  • Linuxaffected: 4.7CVE List
  • Linuxunaffected: all versions before 4.7CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7