CVE-2026-97548 (GCVE-0-2026-97548)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
Summary
In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions The _maxlevels_ondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount versions of these functions forget to account for the inode root, which means that we could access beyond the end of the cursor given a sufficiently large btree. Fix this.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < 108114437915e61e8f88d1cbcc442c3f886a347e (git)
Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < 84316cb25af95a60e655ccc8fe646bb5ad631b71 (git)
Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < aa301322f72f82f26e4ba0826018d41388ab9896 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "108114437915e61e8f88d1cbcc442c3f886a347e",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "84316cb25af95a60e655ccc8fe646bb5ad631b71",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "aa301322f72f82f26e4ba0826018d41388ab9896",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions\n\nThe _maxlevels_ondisk functions are used to compute the size of\nin-memory btree cursors for each btree type.  Unfortunately, LOLLM\nnoticed that the rtrmap and rtrefcount versions of these functions\nforget to account for the inode root, which means that we could access\nbeyond the end of the cursor given a sufficiently large btree.  Fix\nthis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven by on-disk XFS fields: sb_blocksize/sb_rgextents consumed by xfs_rtrefcountbt_compute_maxlevels() and the /rtgroups/N.refcount inode-root bb_level loaded by xfs_iformat_rtrefcount(). Entry is mount(2)\u2192xfs_init_fs_context()\u2192get_tree_bdev()\u2192xfs_fs_fill_super()\u2192xfs_mountfs()\u2192xfs_log_mount_finish()\u2192xlog_recover_finish()\u2192xfs_reflink_recover_cow(); no NFS/SMB/TCP message carries bb_level.\nAC:L - xfs_rtrefcountbt_maxlevels_ondisk() sizes the xfs_rtrefcountbt_cur slab for 6 bc_levels slots. A 1K-block rtreflink image with large sb_rgextents makes xfs_rtrefcountbt_compute_maxlevels() set m_rtrefc_maxlevels=7; xfs_iformat_rtrefcount() accepts bb_level=6, so xfs_rtrefcountbt_init_cursor() sets bc_nlevels=7 and xfs_btree_lookup() stores bc_levels[6].ptr. A dirty log makes xlog_recovery_needed() true so this runs on every mount; no race.\nPR:N - Crafting the image needs no host account. xfs_fs_type.fs_flags is FS_REQUIRES_DEV|FS_ALLOW_IDMAP|FS_MGTIME|FS_LBS with no FS_USERNS_MOUNT, so mount_capable() is capable(CAP_SYS_ADMIN) in init_user_ns; that privileged mount of the attacker image is scored as UI:R, not attacker privilege.\nUI:R - xfs_rtrefcountbt_init_cursor() runs from xfs_refcount_recover_cow_leftovers() in xfs_reflink_recover_cow() during xlog_recover_finish() after xfs_fs_fill_super() attaches the attacker bdev. Because XFS is not FS_USERNS_MOUNT, a victim, automounter, or administrator must mount that image before the undersized cursor is built.\nS:U - The bc_levels[] store in xfs_btree_lookup() corrupts the xfs_rtrefcountbt_cur slab in the host kernel that mounted the volume; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.\nC:H - xfs_btree_lookup() writes cur-\u003ebc_levels[level].ptr (uint16_t) at level=bc_nlevels-1 when the xfs_rtrefcountbt_cur object from xfs_rtrefcountbt_maxlevels_ondisk() has only 6 slots; that slab OOB write can disclose or influence adjacent heap objects.\nI:H - The same out-of-bounds store of bc_levels[6].ptr past the 6-slot xfs_rtrefcountbt_cur kmem_cache object is a kernel heap write into whatever follows the cursor, enabling adjacent-object corruption toward an arbitrary write or control-flow hijack.\nA:H - xfs_btree_simple_query_range() calls xfs_btree_lookup() on that undersized cursor from xfs_refcount_recover_cow_leftovers() during mount recovery; indexing bc_levels[6] oopses or panics the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:11.843Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e"
        },
        {
          "url": "https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896"
        }
      ],
      "title": "xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97548",
    "datePublished": "2026-09-25T10:21:42.239Z",
    "dateReserved": "2026-09-24T16:01:01.154Z",
    "dateUpdated": "2026-09-25T14:41:11.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97548",
      "date": "2026-09-28",
      "epss": "0.00172",
      "percentile": "0.05863"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
                  "fs/xfs/libxfs/xfs_rtrmap_btree.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "108114437915e61e8f88d1cbcc442c3f886a347e",
                    "status": "affected",
                    "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84316cb25af95a60e655ccc8fe646bb5ad631b71",
                    "status": "affected",
                    "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aa301322f72f82f26e4ba0826018d41388ab9896",
                    "status": "affected",
                    "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
                  "fs/xfs/libxfs/xfs_rtrmap_btree.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions\n\nThe _maxlevels_ondisk functions are used to compute the size of\nin-memory btree cursors for each btree type.  Unfortunately, LOLLM\nnoticed that the rtrmap and rtrefcount versions of these functions\nforget to account for the inode root, which means that we could access\nbeyond the end of the cursor given a sufficiently large btree.  Fix\nthis."
          }
        ],
        "id": "CVE-2026-97548",
        "lastModified": "2026-09-25T15:17:58.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:05.183",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.