Executive brief
A vulnerability was identified in the Linux kernel's XFS file system component, which manages how data is stored on disks. The issue involves an incorrect check when the system calculates how much space it needs to reserve for internal file mapping operations. If this check fails to account for additional overhead, it could lead to system instability or errors when the file system attempts to perform complex data exchanges.
Technical details
A vulnerability in xfs_exchmaps_estimate_overhead() in the XFS subsystem of the Linux kernel stems from an incorrect bounds check. The function adds BMBT and RMAPBT overhead to a local variable 'resblks', but the subsequent UINT_MAX validation incorrectly checks the original 'req->resblks' value instead of the newly computed total. Because this value is later passed to xfs_trans_alloc() as an unsigned int, an overflow or invalid reservation could occur. This issue has been resolved by ensuring the limit check applies to the final computed reservation value. Patches are available in various stable kernel branches including 6.12.96, 6.18.39, and 7.1.4.
Affected products
- Linux Linux Kernel 6.10 to 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-07-25: advisory
- 2026-07-25: disclosed