Skip to main content

Linux CVE-2026-98872

| EUVDEUVD-2026-108718
2026-10-23 Linux GHSA-35fj-5v77-5rpx
Denial Of Service Linux
View
Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

freevxfs: don't BUG() on unknown typed-extent type

vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file:

kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257

Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f1f2d54a576f0e4133b979e545abcfefd439c300
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <704d48d81dc41470e108811c32c577ada66192d4
Linux 0 <6.6.158
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <fe40a19d571cbb584eea46038ee919d8712b2d2c
Linux patch: 5.15.222
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <500e9d5bf9eff2096a21b7ac25a0a06ca46ab821
Linux 0 <6.18.53
Linux 0 <6.1.189
Linux patch: 6.1.189
Linux patch: 7.2
Linux 0 <6.12.111
Linux patch: 6.6.158
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1284d687d46953fff9c0d969df108114611aca8b
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7ada9807e37103b41f586d34e3075e1209182b65
Linux patch: 5.10.271
Linux patch: 6.12.111
Linux 0 <5.10.271
Linux patch: 6.18.53
Linux 0 <5.15.222
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <405f13d7b270913e06e8e2b4de568985f94ef7d6

Affected Packages

euvd linux fix: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

2
Patch available
Oct 23, 2026 - 12:16 EUVD
CVE Published
Oct 23, 2026 - 11:37 cve.org
UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Data Quality
3 sources
Confidence: Low
EUVD CVE.org EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity Not scored yet
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
No CVSS yet + weak signal (CWE or non-zero EPSS)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-98872 REF https://git.kernel.org/stable/c/1284d687d46953fff9c0d969df108114611aca8b REF https://git.kernel.org/stable/c/405f13d7b270913e06e8e2b4de568985f94ef7d6 REF https://git.kernel.org/stable/c/500e9d5bf9eff2096a21b7ac25a0a06ca46ab821 REF https://git.kernel.org/stable/c/704d48d81dc41470e108811c32c577ada66192d4 REF https://git.kernel.org/stable/c/7ada9807e37103b41f586d34e3075e1209182b65 REF https://git.kernel.org/stable/c/f1f2d54a576f0e4133b979e545abcfefd439c300 REF https://git.kernel.org/stable/c/fe40a19d571cbb584eea46038ee919d8712b2d2c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy