Executive brief
A vulnerability was identified in the Linux kernel's XFS file system involving how it handles file data mappings during high-performance 'direct I/O' operations. Under specific conditions, the system could use outdated information about where data is stored on the physical disk, potentially leading to data corruption or inconsistent file states during simultaneous write operations. This issue primarily affects systems using XFS with 'reflink' features enabled, such as those used for efficient file cloning or snapshots.
Technical details
A race condition exists in the XFS reflink implementation within the Linux kernel. The functions xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc cycle the ILOCK to acquire a transaction, which can cause existing data fork mappings to become stale if a racing O_DIRECT writer completes a Copy-on-Write (CoW) cycle in the interim. Because the data fork mapping was not refreshed after reacquiring the ILOCK, xfs_bmap_trim_cow could query the refcount btree using incorrect physical blocks. This results in an inaccurate 'shared' status, causing direct I/O writes to proceed with stale mappings. The fix introduces a check of the data fork sequence counter (if_seq) to trigger a re-read of the mapping if it changed during the ILOCK cycle.
Affected products
- Linux Linux Kernel 4.11 to 7.2-rc4
Timeline
- 2026-07-13: disclosed: Initial patch authored
- 2026-07-23: advisory: CVE published in NVD