In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fs_acl_from_disk() f2fs_acl_count() only validates the aggregate ACL xattr length. A malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk() then reads entry->e_id before verifying that a full entry fits. Require a short entry before reading e_tag and e_perm, and require a full entry before reading e_id for ACL_USER and ACL_GROUP. Return -EFSCORRUPTED from these new truncated-entry checks, while keeping the pre-existing -EINVAL paths unchanged. Validation reproduced this kernel report: KASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0 RIP: 0033:0x7f4b835ea7aa The buggy address belongs to the object at ffff888114589960 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888114589960, ffff888114589968) Read of size 4
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-63814 is a validation bypass vulnerability in the Linux kernel's f2fs filesystem implementation affecting ACL (Access Control List) entry parsing. The vulnerability exists in f2fs_acl_from_disk(), where insufficient bounds checking allows malformed ACL xattr data to trigger out-of-bounds memory reads. An attacker with write access to a malicious f2fs filesystem image could craft a specially formatted ACL entry that causes the kernel to read beyond allocated buffer boundaries, potentially leading to information disclosure or denial of service. This affects any system mounting untrusted f2fs filesystems, including container environments and embedded systems using f2fs.
While this CVE shows no direct MITRE ATT&CK mapping in current threat intelligence, Casky's 754 mapped security skills using Claude's extended reasoning would identify attack patterns associated with memory safety violations and privileged code execution. Practitioners using Casky would detect this through skills mapping to techniques like T1190 (Exploit Public-Facing Application) and T1548 (Abuse Elevation Control Mechanism), as exploiting this kernel vulnerability requires either local filesystem manipulation or mounting capabilities. The platform's reasoning engine would flag the insufficient validation logic as enabling either T1005 (Data from Local System) through memory disclosure or T1499 (Endpoint Denial of Service) through kernel crashes, helping practitioners prioritize patching based on their specific threat model and f2fs usage.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-63814. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation