Executive brief
A vulnerability in the Linux kernel's XFS file system driver can lead to data corruption and unmountable storage volumes. This occurs when the system incorrectly calculates log parameters for certain disk configurations, such as those with 4k physical sectors. An attacker or a malformed disk image could exploit this to cause a permanent loss of access to data or system instability.
Technical details
A vulnerability exists in the XFS filesystem driver within the Linux kernel due to undersized l_iclog_roundoff values. When a superblock does not specify a log stripe unit (sb_logsunit), the kernel defaults the incore log roundoff value to 512 bytes (BBSIZE) even if the physical sector size is larger (e.g., 4096 bytes). This mismatch can result in 'torn writes' and CRC failures during log recovery, rendering the filesystem unmountable. While the issue can be triggered by malformed filesystems generated by specific versions of mkfs, it also represents a security risk as the on-disk superblock can be fuzzed or manipulated to trigger the corruption. The fix ensures the roundoff value respects the log sector size (sb_logsectsize) if it is greater than zero.
Affected products
- Linux Linux Kernel v5.14 and later
Timeline
- 2026-03-04: other: Patch authored
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2ecda4b83749c1fef0c9dea4fd5e8b513aba3e40
- https://git.kernel.org/stable/c/41e91dff2d3974730b5ee50daa8e27ec254cbf91
- https://git.kernel.org/stable/c/446a1f5bb64ba38adb93cb043ff0f7b85e8937ca
- https://git.kernel.org/stable/c/52a8a1ba883defbfe3200baa22cf4cd21985d51a
- https://git.kernel.org/stable/c/5afae524f83d6a18517298491a5624cb0eae5029
- https://git.kernel.org/stable/c/5e7148402dfc4a5b7894d8e97b15e5c2e70924aa
- https://git.kernel.org/stable/c/e88ce9f0536f3b2149afb70625cfc4bd74a4ac6d