EUVD-2026-66445
GHSA-qxc6-78q3-77vp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local vector confirmed by filesystem-level trigger; PR:L because attacker needs file ownership on reflinked files; C:H and I:H reflect CoW bypass enabling cross-inode data exposure and corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that currently has it to the other file, as long as exactly one side is marked. This assumes that the file contents, and therefore all shared extents, are exchanged.
That assumption is not true when XFS_EXCHMAPS_INO1_WRITTEN is set. xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1, so an exchange can complete without moving every mapping that the earlier flag-swap decision accounted for. In that case the post-operation cleanup can clear the reflink flag from an inode that still owns shared written extents. Later writes then take the non-reflink write path and may update blocks that should still have been protected by CoW, which shows up as data corruption between reflink-related files.
Fix this by disabling the reflink flag exchange whenever XFS_EXCHMAPS_INO1_WRITTEN is requested. The contents exchange can still proceed; the conservative outcome is that both inodes keep the reflink flag. The regular reflink flag cleanup path can drop the extra flag later once the inode no longer has shared extents.
AnalysisAI
Data corruption in the Linux kernel's XFS exchange-range subsystem allows a low-privileged local attacker to trigger incorrect reflink inode flag clearing, causing subsequent writes to bypass Copy-on-Write protection on shared extents. Affected are Linux kernel versions prior to 6.12.105, 7.1.10, and 7.2 on systems using XFS volumes with reflink support enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local user access on the target system, with at least low privileges (file ownership or write permission on the affected files - PR:L per CVSS); (2) the system must be running a Linux kernel version prior to the fix commits on the 6.12, 7.1, or 7.2 branches; (3) the target filesystem must be XFS mounted with reflink support enabled (this is the default on RHEL 8+ and derivatives but is not universal across all Linux deployments); (4) target files must be reflinked - i.e., sharing physical extents via a prior clone or cp --reflink operation; and (5) the attacker must be able to invoke the XFS exchange-range operation with XFS_EXCHMAPS_INO1_WRITTEN set on the reflinked files. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the threat model: a low-privileged local user on an XFS system with reflinked files can corrupt data shared across inodes without any user interaction or elevated access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege access to a Linux system running an unpatched kernel on an XFS volume with reflink-enabled files invokes the exchange-range syscall with XFS_EXCHMAPS_INO1_WRITTEN set, targeting a pair of reflinked files. The kernel's flag-swap logic incorrectly clears the reflink flag from the source inode after the incomplete extent exchange, and subsequent writes to that inode bypass CoW protection, silently corrupting data blocks shared with the destination inode. … |
| Remediation | Upgrade to Linux kernel 6.12.105, 7.1.10, or 7.2 (or later), which incorporate the four upstream fix commits: 2efbd8890b53f4756fdc7b0ef346fa514ffb7d66, 0f27b22343b63e10773e6781344640c2c753eec3, 03c9c9116e6da641424681f705698d7f5e2128e0, and b2d5a81dae385333f9734910277fbf94c78bd17f, all available at https://git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production and non-production Linux systems running XFS filesystem with reflink support enabled, prioritizing RHEL 8/9 and Oracle Linux where XFS is the default filesystem. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today