Linux Kernel XFS EUVD-2026-86856

Requires local operation on an XFS filesystem configured with a realtime device AND the reverse-mapping (rtrmapbt) or reflink/refcount (rtrefcountbt) features enabled, plus a realtime rmap or refcount btree tall enough that the under-counted maxlevels causes cursor allocation to be too small. Limiting factors: local access only (AV:L), the feature combination is non-default and uncommon, and the condition is explicitly gated on 'a sufficiently large btree,' so ordinary or small filesystems are not affected. UI:R in the supplied vector implies a victim action such as mounting or operating on an attacker-crafted image.

The input assigns CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the vector and the description are in tension. The bug is that xfs rtrmap and rtrefcount _maxlevels_ondisk helpers undercount btree height by omitting the inode root, so the kernel can under-size an in-memory btree cursor and then access memory beyond its end - only 'given a sufficiently large btree.' That is a local-only issue (AV:L is consistent) and is fundamentally a memory-safety / out-of-bounds access defect, most plausibly manifesting as corruption or a crash rather than reliable C:H/I:H disclosure/tampering. The AC:L rating understates the difficulty: triggering requires XFS with the realtime device plus rmap/reflink (rtrmapbt/rtrefcountbt) features and a realtime btree tall enough to exceed the miscomputed maxlevels - not a default or easily arranged state. No EPSS score, no CISA KEV listing, and no public POC are provided; there is no SSVC decision record in the input. Signals therefore align on LOW real-world urgency: this is a defense-in-depth hardening fix (LOLLM/static-analysis-noticed, self-reported by the Linux kernel maintainers) rather than an actively exploited flaw. The headline 7.8 overstates practical risk for a niche, config-gated, crash-dominant kernel path; treat as routine stable-kernel patch hygiene.

A local user (or a crafted/large XFS realtime filesystem image that a victim mounts and operates on) drives operations against an unusually tall realtime rmap or refcount btree; the kernel allocates a cursor sized from the buggy maxlevels calculation and then indexes past its end, corrupting adjacent kernel memory or panicking. No public exploit code is identified at time of analysis, and reliable code execution or data disclosure from this out-of-bounds access is unproven.