EUVD-2026-66452
GHSA-7pr9-p5w4-7qf6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only mount vector (AV:L), low privilege required to mount filesystems (PR:L), no race or complex conditions once image is crafted (AC:L), full kernel impact on exploitation (C/I/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix off-by-one in rtrefcount btree root level validation
xfs_rtrefcountbt_compute_maxlevels() sets
mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;
where the trailing "+ 1" already accounts for the inode-root level, so the deepest valid on-disk root level is m_rtrefc_maxlevels - 1 and a cursor must satisfy bc_nlevels <= bc_maxlevels (= m_rtrefc_maxlevels).
The two on-disk validation paths, xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount(), check the root level with ">" instead of ">=", so a crafted rtreflink (metadir + realtime + reflink) image whose /rtgroups/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on mount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1, exceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is sized for exactly bc_maxlevels entries, the first btree op on such a cursor indexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is reached by the first rtrefcount cursor built after mount, via log/CoW recovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an FS_IOC_GETFSMAP over the realtime device.
Reject a root level equal to m_rtrefc_maxlevels, matching the ">=" form already used by the sibling data-device refcount/rmap verifiers and the in-memory rtrmap verifier.
BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101) Write of size 2 at addr ffff888018391658 by task exploit/144 xfs_btree_lookup (fs/xfs/libxfs/xfs_btree.c:2101) xfs_btree_query_range (fs/xfs/libxfs/xfs_btree.c:5308) xfs_refcount_recover_cow_leftovers (fs/xfs/libxfs/xfs_refcount.c:2113) xfs_reflink_recover_cow (fs/xfs/xfs_reflink.c:1085) xlog_recover_finish (fs/xfs/xfs_log_recover.c:3551) xfs_mountfs (fs/xfs/xfs_mount.c:1158) xfs_fs_fill_super (fs/xfs/xfs_super.c:1940) get_tree_bdev_flags (fs/super.c:1634) vfs_get_tree (fs/super.c:1694) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216 The buggy address is located 8 bytes to the right of allocated 216-byte region [ffff888018391578, ffff888018391650) Kernel panic - not syncing: Fatal exception
AnalysisAI
Slab-out-of-bounds write in the Linux kernel XFS real-time refcount B-tree (rtrefcountbt) subsystem allows a local attacker to trigger a kernel panic or potentially escalate privileges by mounting a crafted XFS filesystem image with the rtreflink feature set. The flaw is an off-by-one in on-disk root level validation - two check paths use '>' instead of '>=' - permitting an illegal bb_level that causes the cursor's bc_nlevels to exceed bc_maxlevels by one, indexing a 2-byte write 8 bytes past the end of a 216-byte slab object during the first B-tree operation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target kernel must be compiled with XFS realtime support (CONFIG_XFS_RT) and the reflink/metadir features enabled; (2) the attacker must be able to cause the kernel to mount a crafted XFS filesystem image with the metadir+realtime+reflink feature set - this requires either CAP_SYS_ADMIN, an enabled unprivileged user namespace mount path, or the ability to present a malicious block device; (3) the crafted image's /rtgroups/N.refcount inode must have bb_level set to exactly m_rtrefc_maxlevels. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the described primitive: low-privilege local access is sufficient, no interaction is required, and the attack complexity is low once a crafted image is prepared. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with low privileges crafts a malicious XFS filesystem image with the metadir+realtime+reflink feature combination, setting the /rtgroups/N.refcount inode's bb_level field to m_rtrefc_maxlevels (one beyond the valid maximum). When the image is mounted - directly by the attacker if unprivileged mounts are permitted, or by tricking an administrator - the kernel's CoW recovery path during xfs_mountfs() builds an rtrefcount cursor and immediately writes two bytes 8 bytes past the slab object boundary, producing a kernel panic at minimum; with heap grooming, an attacker may achieve arbitrary kernel code execution and root privilege escalation. |
| Remediation | Apply one of the three upstream fix commits available on the Linux kernel stable tree - the fix is included in patched kernel releases 7.2, 7.1.10, and 6.18.46 per EUVD-2026-66452; monitor your distribution (RHEL, Ubuntu, SUSE, Debian) for a kernel update incorporating these commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately secure a copy of the vendor patch for your Linux distribution within 24 hours, and audit systems for XFS filesystem usage and rtreflink feature configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today