EUVD-2026-66453
GHSA-5q37-jjr8-c4m5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Growfs requires root-level privilege (PR:H) and exploitation demands a non-default XFS realtime subvolume plus a concurrent storage error (AC:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xfs: propagate errors from xfs_rtginode_load
xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded.
Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller.
AnalysisAI
Error propagation failure in the Linux kernel's XFS realtime filesystem subsystem corrupts filesystem state during xfs_growfs operations. The function xfs_rtginode_ensure() silently discards all non-ENOENT errors returned by xfs_rtginode_load(), leaving the realtime group inode pointer unset while growfs proceeds as though load succeeded - producing a null pointer dereference, kernel panic, or realtime subvolume metadata corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account with privileges sufficient to influence or trigger xfs_growfs execution on the target system (typically root, which conflicts with the PR:L CVSS rating - see confidence notes). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) captures the local attack vector and high integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege access on a system running a vulnerable kernel triggers or waits for a transient I/O error on an XFS realtime subvolume during a growfs operation - achievable in virtualized environments by injecting block device errors or by operating on degraded storage. The xfs_rtginode_load() call returns EIO, which xfs_rtginode_ensure() discards as though the inode was successfully loaded, leaving gi_inode NULL. … |
| Remediation | The primary fix is to upgrade to Linux kernel 6.18.46, 7.1.10, or 7.2, which contain the corrected error propagation logic in xfs_rtginode_ensure(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernels with XFS realtime filesystems enabled and document current kernel versions across the environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today