CVE-2026-98446

Received Received - Intake

XFS Filesystem Metadata Reservation Integer Underflow

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_resv_init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space. We never want the target to be less than the used sapce, so fix the logic that adjusts dblocks_avail downwards. Also fix an error in the adjacent comment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98446

EUVD

EUVD-2026-103686

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1df8d75030b787a9fae270b59b93eef809dd2011
Linux	Linux	1df8d75030b787a9fae270b59b93eef809dd2011
Linux	Linux	1df8d75030b787a9fae270b59b93eef809dd2011
Linux	Linux	6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a logic error in the XFS filesystem. It occurs when calculating available space for metadata btree files. The system incorrectly allows the reserved space to go below the space already used by the file, causing an underflow. This leads to an incorrect calculation of available disk blocks, potentially causing xfs_dec_fdblocks to subtract an abnormally large amount of space.

Detection Guidance

This vulnerability is specific to the XFS filesystem in the Linux kernel. Detection requires checking kernel logs for filesystem-related errors or monitoring for unusual space accounting issues in XFS metadata operations. Use commands like dmesg | grep XFS or journalctl -k | grep XFS to review kernel logs for XFS-related errors.

Impact Analysis

This vulnerability could cause the system to incorrectly report or manage disk space, leading to potential data corruption, filesystem errors, or unexpected system crashes. It may also result in applications failing due to incorrect space availability assumptions.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA by potentially causing data integrity issues in the Linux kernel's XFS filesystem. If exploited, it could lead to incorrect accounting of available disk space, which may result in data corruption or loss. Such integrity failures could violate compliance requirements for data protection and availability.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider temporarily avoiding heavy filesystem operations on XFS volumes or restricting access to metadata-heavy workloads until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70