In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almost full. By investigation, we find that the reason is one f2fs page got freed to buddy without being deleted from LRU and the root cause is the race happened in [2] which is enrolled by this commit. There are 3 race processes in this scenario, please find below for their main activities. The changed code in move_data_block() lets the GC path evict the tail-end folio from the page cache through folio_end_dropbehind(). Once folio_unmap_invalidate() removes the folio from mapping->i_pages, the page-cache references for all pages in the folio are dropped. The folio is then kept alive only by temporary external references, which allows a later split to operate on a folio whose subpages are n
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-63813 addresses a critical race condition in the Linux kernel's F2FS (Flash-Friendly File System) implementation that causes kernel panics when file system partitions reach near-capacity. The vulnerability stems from a memory management issue where F2FS pages are freed to the buddy allocator without being properly removed from the LRU (Least Recently Used) cache, resulting in use-after-free conditions and system instability. This affects any Linux system using F2FS, particularly those with storage constraints or high write volumes that trigger the race condition at capacity thresholds. The issue is particularly dangerous in embedded systems, IoT devices, and containerized environments where F2FS is commonly deployed.
While this CVE lacks explicit MITRE ATT&CK mappings, the underlying memory corruption vulnerability relates to adversarial manipulation of kernel data structures—a pattern Casky practitioners would detect through memory safety analysis and kernel state monitoring. Although not directly mapped to offensive techniques, a security team using Casky's Claude-powered reasoning engine would identify this as a T1499 (Endpoint Denial of Service) vector, as attackers could intentionally fill F2FS partitions to trigger the panic condition. Practitioners would observe kernel crashes, memory corruption indicators, and system instability in their telemetry—findings that correlate with exploitation attempts targeting kernel stability and resource exhaustion attack patterns.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-63813. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation