CVE-2026-64600

Analyzed Analyzed - Analysis Complete

XFS Data Fork Mapping Resampling After ILOCK Cycle

Publication date: 2026-07-23

Last updated on: 2026-08-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-08-18

Generated

2026-09-01

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-31

NVD

CVE-2026-64600

EUVD

EUVD-2026-47879

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 4.11 (inc) to 5.15.212 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the XFS file system. When handling copy-on-write operations, the code cycles the inode lock (ILOCK) to access a transaction but fails to refresh the data fork mapping afterward. This leads to stale mappings being used, causing incorrect block queries and potential data corruption during direct I/O writes.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem and requires kernel-level inspection. Detection involves checking kernel logs for XFS-related errors or verifying if your system runs a vulnerable kernel version. Use commands like 'uname -a' to check kernel version and 'dmesg | grep XFS' to look for filesystem errors.

Impact Analysis

If exploited, this flaw could allow attackers to corrupt data or cause system crashes by manipulating file system operations. Users relying on XFS for storage may experience data loss or inconsistent file states, particularly during high-concurrency write operations.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially compromising sensitive data integrity. For GDPR, it may violate Article 32 (security of processing) if personal data is altered. For HIPAA, it could breach integrity requirements under the Security Rule if protected health information is modified. The lack of audit trails increases compliance risks.

Mitigation Strategies

Update your Linux kernel to the latest stable version provided by your distribution. If an update is not immediately available, consider disabling XFS reflink features temporarily or restricting access to affected systems until patched.

Hi! I’m here to help you understand CVE-2026-64600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70