CVE-2026-63818

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate orphan inode entry count

f2fsrecoverorphaninodes() trusts the orphan block entrycount when replaying orphan inodes from the checkpoint pack. A corrupted entrycount larger than F2FSORPHANSPERBLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.

On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fsbugon() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.

Set ERRORINCONSISTENTORPHAN as well, so the corruption reason can be recorded in the superblock serrors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBINEED_FSCK through a checkpoint.