CVE-2026-64357

Awaiting Analysis Awaiting Analysis - Queue

XFS Filesystem Reservation Limit Bypass

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added. The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64357

EUVD

EUVD-2026-48901

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a miscalculation in the XFS filesystem's block reservation system. The function xfs_exchmaps_estimate_overhead() incorrectly checks the original reservation value instead of the updated one after adding overhead for bmbt and rmapbt structures. This could lead to an integer overflow when the computed reservation exceeds UINT_MAX, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem and does not have a direct network detection method. To check if your system is affected, verify the kernel version and whether the XFS filesystem is in use. Commands like 'uname -r' and 'mount | grep xfs' can help identify the kernel and filesystem. If your kernel version is older than the patched version, the system may be vulnerable.

Impact Analysis

If exploited, this vulnerability could cause the Linux kernel to crash or become unstable due to incorrect memory or resource allocation. Users might experience system freezes, data corruption, or denial of service if the kernel fails to handle the reservation overflow properly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel memory management issue in the XFS filesystem that could lead to incorrect block reservation calculations, potentially causing system instability or crashes. There is no evidence it impacts data privacy, security controls, or regulatory compliance requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. This can typically be done using your distribution's package manager, such as 'sudo apt update && sudo apt upgrade' for Debian-based systems or 'sudo yum update' for RHEL-based systems. After updating, reboot the system to ensure the new kernel is active.

Hi! I’m here to help you understand CVE-2026-64357. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70