CVE-2026-63813 addresses a race condition in the Linux kernel's f2fs filesystem, specifically in the move_data_block() function. The vulnerability arises from a commit that allowed the garbage collector path to evict the tail-end folio from the page cache, dropping page-cache references prematurely. This enables a race where split_folio_to_order() splits a folio into pages and re-adds them to the LRU list, while concurrently folio_isolate_lru() clears the PG_lru flag and takes references. If these operations race, a page can be freed while still linked in the LRU list, causing list corruption and kernel panics. The issue was resolved by reverting the commit that introduced this behavior.

The vulnerability causes kernel panics and list corruption errors, leading to system instability and crashes when the f2fs partition approaches full capacity. This can disrupt system availability and may require rebooting or recovery actions.

A fix is available as the vulnerability was resolved by reverting the problematic commit in the Linux kernel. Users should update to a Linux kernel version that includes this revert to prevent kernel panics related to this issue. Since this is a kernel-level fix, applying the updated kernel is the recommended remediation.