Vulnerability-Lookup

FKIE_CVE-2026-97548

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 15:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions The _maxlevels_ondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount versions of these functions forget to account for the inode root, which means that we could access beyond the end of the cursor given a sufficiently large btree. Fix this.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "108114437915e61e8f88d1cbcc442c3f886a347e",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "84316cb25af95a60e655ccc8fe646bb5ad631b71",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "aa301322f72f82f26e4ba0826018d41388ab9896",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions\n\nThe _maxlevels_ondisk functions are used to compute the size of\nin-memory btree cursors for each btree type.  Unfortunately, LOLLM\nnoticed that the rtrmap and rtrefcount versions of these functions\nforget to account for the inode root, which means that we could access\nbeyond the end of the cursor given a sufficiently large btree.  Fix\nthis."
    }
  ],
  "id": "CVE-2026-97548",
  "lastModified": "2026-09-25T15:17:58.553",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-25T11:17:05.183",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-97548 (GCVE-0-2026-97548)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41

Title

xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/108114437915e61e8…
https://git.kernel.org/stable/c/84316cb25af95a60e…
https://git.kernel.org/stable/c/aa301322f72f82f26…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < 108114437915e61e8f88d1cbcc442c3f886a347e (git) Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < 84316cb25af95a60e655ccc8fe646bb5ad631b71 (git) Affected: 9abe03a0e4f978615a2b1b484b8d09ca84c16ea0 , < aa301322f72f82f26e4ba0826018d41388ab9896 (git)
Linux	Linux	Affected: 6.14 Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "108114437915e61e8f88d1cbcc442c3f886a347e",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "84316cb25af95a60e655ccc8fe646bb5ad631b71",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "aa301322f72f82f26e4ba0826018d41388ab9896",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions\n\nThe _maxlevels_ondisk functions are used to compute the size of\nin-memory btree cursors for each btree type.  Unfortunately, LOLLM\nnoticed that the rtrmap and rtrefcount versions of these functions\nforget to account for the inode root, which means that we could access\nbeyond the end of the cursor given a sufficiently large btree.  Fix\nthis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven by on-disk XFS fields: sb_blocksize/sb_rgextents consumed by xfs_rtrefcountbt_compute_maxlevels() and the /rtgroups/N.refcount inode-root bb_level loaded by xfs_iformat_rtrefcount(). Entry is mount(2)\u2192xfs_init_fs_context()\u2192get_tree_bdev()\u2192xfs_fs_fill_super()\u2192xfs_mountfs()\u2192xfs_log_mount_finish()\u2192xlog_recover_finish()\u2192xfs_reflink_recover_cow(); no NFS/SMB/TCP message carries bb_level.\nAC:L - xfs_rtrefcountbt_maxlevels_ondisk() sizes the xfs_rtrefcountbt_cur slab for 6 bc_levels slots. A 1K-block rtreflink image with large sb_rgextents makes xfs_rtrefcountbt_compute_maxlevels() set m_rtrefc_maxlevels=7; xfs_iformat_rtrefcount() accepts bb_level=6, so xfs_rtrefcountbt_init_cursor() sets bc_nlevels=7 and xfs_btree_lookup() stores bc_levels[6].ptr. A dirty log makes xlog_recovery_needed() true so this runs on every mount; no race.\nPR:N - Crafting the image needs no host account. xfs_fs_type.fs_flags is FS_REQUIRES_DEV|FS_ALLOW_IDMAP|FS_MGTIME|FS_LBS with no FS_USERNS_MOUNT, so mount_capable() is capable(CAP_SYS_ADMIN) in init_user_ns; that privileged mount of the attacker image is scored as UI:R, not attacker privilege.\nUI:R - xfs_rtrefcountbt_init_cursor() runs from xfs_refcount_recover_cow_leftovers() in xfs_reflink_recover_cow() during xlog_recover_finish() after xfs_fs_fill_super() attaches the attacker bdev. Because XFS is not FS_USERNS_MOUNT, a victim, automounter, or administrator must mount that image before the undersized cursor is built.\nS:U - The bc_levels[] store in xfs_btree_lookup() corrupts the xfs_rtrefcountbt_cur slab in the host kernel that mounted the volume; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.\nC:H - xfs_btree_lookup() writes cur-\u003ebc_levels[level].ptr (uint16_t) at level=bc_nlevels-1 when the xfs_rtrefcountbt_cur object from xfs_rtrefcountbt_maxlevels_ondisk() has only 6 slots; that slab OOB write can disclose or influence adjacent heap objects.\nI:H - The same out-of-bounds store of bc_levels[6].ptr past the 6-slot xfs_rtrefcountbt_cur kmem_cache object is a kernel heap write into whatever follows the cursor, enabling adjacent-object corruption toward an arbitrary write or control-flow hijack.\nA:H - xfs_btree_simple_query_range() calls xfs_btree_lookup() on that undersized cursor from xfs_refcount_recover_cow_leftovers() during mount recovery; indexing bc_levels[6] oopses or panics the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:11.843Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e"
        },
        {
          "url": "https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896"
        }
      ],
      "title": "xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97548",
    "datePublished": "2026-09-25T10:21:42.239Z",
    "dateReserved": "2026-09-24T16:01:01.154Z",
    "dateUpdated": "2026-09-25T14:41:11.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-97548

CVE-2026-97548 (GCVE-0-2026-97548)

Tags

Sightings

Nomenclature

Related by attack behaviour