CVE-2026-64600
Received Received - Intake

XFS Data Fork Mapping Resampling After ILOCK Cycle

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-64600
EUVD
EUVD-2026-47879

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the XFS file system. When handling copy-on-write operations, the code cycles the inode lock (ILOCK) to access a transaction but fails to refresh the data fork mapping afterward. This leads to stale mappings being used, causing incorrect block queries and potential data corruption during direct I/O writes.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem and requires kernel-level inspection. Detection involves checking kernel logs for XFS-related errors or verifying if your system runs a vulnerable kernel version. Use commands like 'uname -a' to check kernel version and 'dmesg | grep XFS' to look for filesystem errors.

Impact Analysis

If exploited, this flaw could allow attackers to corrupt data or cause system crashes by manipulating file system operations. Users relying on XFS for storage may experience data loss or inconsistent file states, particularly during high-concurrency write operations.

Mitigation Strategies

Update your Linux kernel to the latest stable version provided by your distribution. If an update is not immediately available, consider disabling XFS reflink features temporarily or restricting access to affected systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart