Skip to main content

Linux Kernel XFS CVE-2026-64357

| EUVDEUVD-2026-48901 MEDIUM
2026-07-25 Linux GHSA-cgx7-q95q-mhc8
Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege user can trigger kernel panic via exchmaps; no confidentiality or integrity impact, only availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 04, 2026 - 16:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 04, 2026 - 16:13 vuln.today
CVSS changed
Sep 04, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchmaps reservation limit check

xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added.

The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.

AnalysisAI

Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.

Technical ContextAI

XFS is a high-performance 64-bit journaling filesystem built into the Linux kernel, with CPE cpe:2.3:a:linux:linux. The exchmaps subsystem implements file extent exchange operations, a relatively recent XFS capability. During extent exchanges, xfs_exchmaps_estimate_overhead() calculates the extra block reservation needed for bmbt (block map B-tree) and rmapbt (reverse map B-tree) updates and accumulates it into a local resblks variable. The computed total is then stored in req->resblks and passed to xfs_trans_alloc(), whose reservation parameter is typed as unsigned int. The UINT_MAX overflow guard was meant to prevent silent truncation of a value exceeding 32-bit range, but the guard reads req->resblks before the local computation is written back, checking the wrong value. This is a classic check-before-update logic error with no formal CWE assigned in this entry. The bug was introduced with commit 966ceafc7a437105ecfe1cadb3747b2965a260ca.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 as appropriate for your stable branch. The upstream fixes are available at the git.kernel.org/stable commit references listed above. For distributions that have not yet backported the fix, the primary workaround is to avoid use of the XFS extent exchange (exchmaps) operation on workloads where block reservation overhead could be very large; however, this is an uncommon operation and most systems will not encounter it spontaneously. There is no configuration knob to disable exchmaps separately from XFS itself, so in high-availability environments that cannot tolerate the kernel panic risk and cannot patch immediately, the most conservative control is to migrate the affected volume to ext4 or another filesystem temporarily. Apply vendor-supplied stable-tree patches at the next available maintenance window.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-GCE-3P Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server for SAP applications 16.0 Fixed

Share

CVE-2026-64357 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy