Linux Kernel XFS EUVD-2026-27712

Requires authenticated local user access with low-privilege account (PR:L) on a Linux system running kernel versions 5.9 through unpatched 6.x/7.x series. Specifically requires the XFS filesystem to be mounted and in use - systems using only ext4, btrfs, or other filesystems are not affected. Exploitation depends on triggering XFS extended attribute operations (xattr syscalls such as setxattr, getxattr, listxattr, or removexattr) that invoke the vulnerable xfs_attr_leaf_hasname() code path with specific error conditions from xfs_attr3_leaf_lookup_int. The attacker must cause error returns other than -ENOATTR or -EEXIST to trigger the dangling pointer condition. Attack complexity is low (AC:L) but successful privilege escalation requires kernel exploitation expertise to reliably control freed memory and achieve code execution. Remote exploitation is not possible (AV:L) - network access alone is insufficient. Systems that do not grant local shell access to untrusted users, or that use filesystems other than XFS, are not practically exploitable regardless of kernel version.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local access with low complexity and low privileges required, enabling high impact across confidentiality, integrity, and availability. However, real-world risk signals are mixed. The EPSS score of 0.02% (5th percentile) suggests extremely low observed exploitation probability in the wild. No CISA KEV listing exists, indicating no confirmed active exploitation. The local attack vector (AV:L) significantly limits exposure compared to network-accessible vulnerabilities - an attacker must already have authenticated shell access to the target system. The low privilege requirement (PR:L) means any local user account suffices, but the attacker cannot be completely unprivileged. The vulnerability affects kernel memory management in XFS extended attribute operations, which are not constantly exercised in typical workloads, further reducing attack surface. While kernel use-after-free vulnerabilities theoretically enable privilege escalation to root, successful exploitation requires precise memory manipulation and timing. For organizations not using XFS filesystems or not granting local shell access to untrusted users, practical risk is minimal despite the high CVSS score. Priority should be moderate - patch during normal maintenance windows unless XFS is used on multi-tenant systems with local user access.

An attacker with a low-privilege local account on a Linux system using XFS filesystem performs extended attribute operations designed to trigger error conditions in xfs_attr3_leaf_lookup_int. By carefully crafting attribute names or manipulating filesystem state to cause specific error codes (excluding -ENOATTR and -EEXIST), the attacker triggers the use-after-free condition where xfs_attr_leaf_hasname returns a pointer to freed buffer memory. The attacker then leverages heap grooming techniques to control the freed memory region and writes malicious data structures into it. When the kernel subsequently dereferences the dangling pointer, it executes attacker-controlled code with kernel privileges, escalating from limited user access to root-level system compromise. No public proof-of-concept is currently identified, and low EPSS score suggests successful exploitation requires significant technical expertise.