CVE-2026-97552
Received Received - Intake

Uninitialized Error in Linux Kernel XFS Filesystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfs_defer_finish_one() xfs_defer_finish_one() declares error without an initialiser and only assigns it inside the loop over dfp->dfp_work. When that list is empty the loop body never runs, control falls through to the "Done with the dfp, free it" path, and the function returns an indeterminate value. An item-less pending item reaches this through xfs_defer_add_barrier(), which xfs_reap_ag_blocks() uses on any CONFIG_XFS_ONLINE_REPAIR kernel. xfs_defer_finish_noroll() treats any non-EAGAIN return as fatal, so a non-zero stack value turns a successful barrier into a SHUTDOWN_CORRUPT_INCORE in the middle of a repair. Zero is the correct result: reaching the free path means the item loop drained without a non-zero error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97552
EUVD
EUVD-2026-86860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the XFS file system. The function xfs_defer_finish_one() fails to initialize the error variable properly. When processing an empty work list, it returns an uninitialized value instead of zero, leading to potential filesystem corruption during repair operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem and requires kernel-level inspection. Detection involves checking for kernel logs or errors related to XFS operations, particularly during filesystem repairs or barrier operations. Commands like dmesg, journalctl -k, or checking XFS-specific logs may reveal corruption or shutdown errors. No direct network detection commands are applicable.

Impact Analysis

If you use a Linux system with XFS filesystem and CONFIG_XFS_ONLINE_REPAIR enabled, this flaw could cause filesystem corruption during repair operations. It may result in data loss or system crashes when the kernel incorrectly interprets the uninitialized error value as a fatal error.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to error handling in the XFS filesystem, which could lead to filesystem corruption or shutdown during repairs. Compliance impacts would only occur if this vulnerability caused data integrity issues or unavailability of systems handling regulated data.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the XFS issue. If using a kernel with CONFIG_XFS_ONLINE_REPAIR enabled, avoid triggering filesystem repairs until patched. Monitor kernel logs for XFS-related errors and consider temporarily disabling online repair if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart