XFS CVE-2026-98975

Requires local access as an unprivileged user (PR:L) on a host running an XFS filesystem with the reflink feature in use (shared/CoW blocks present). The attacker must perform an XFS exchange-range operation using EXCHANGE_RANGE_TO_EOF (or the legacy XFS_IOC_SWAPEXT ioctl) on files that still own shared blocks beyond i_disk_size; the fix also had to add a CoW fork and set the reflink flag on both inodes in the swapext path. Limiting factors: exploitation is local only (no network vector), is specific to XFS with reflink-shared data, and triggers silent data corruption rather than code execution - there is no user-interaction or remote path. The corruption persists until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a truncate-to-zero clears the flag.

Signals conflict on urgency. The CVSS base score is 7.8 (High) but the vector is explicitly local: AV:L/AC:L/PR:L/UI:N - a low-privileged local user, no remote reach, no user interaction. EPSS is low at 0.21% (11th percentile), there is no CISA KEV listing, and the only references are the kernel.org stable fix commits plus the NVD entry, so no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency data-integrity defect rather than an actively exploited remote RCE. Note a mismatch between the input and the described mechanism: the input CVSS sets C:H/I:H/A:H, but the description is a silent data-corruption bug (reflink flag wrongly cleared, later write goes in-place instead of CoW, corrupting a second file sharing the block) - that is fundamentally an integrity problem, not confidentiality or availability; the blanket C:H/I:H/A:H looks like the automated kernel-CVE default rather than a mechanism-grounded score. Net: a real correctness/integrity issue worth patching on a normal cycle, not a drop-everything priority, because exploitation requires local access and XFS-specific operations and there is no evidence of exploitation or weaponization.

A local user on a system with an XFS filesystem that has reflink-shared (deduplicated/CoW) blocks invokes an exchange-range or legacy swapext operation that resizes a file without unmapping its shared blocks past i_disk_size. The reflink flag is incorrectly cleared, so a subsequent write lands in place instead of copy-on-write, silently corrupting the other file that still shares that block. No public exploit code is available; the trigger path is described in the fix commit but not released as a working PoC.