Executive brief
The Linux kernel's XFS filesystem checker contains a bug in its online repair tool that can cause the system to hang indefinitely when attempting to repair damaged unlinked inode lists. An attacker or malicious filesystem could trigger this infinite loop, potentially causing a denial of service by forcing the repair utility into an unresponsive state.
Technical details
The vulnerability exists in the xrep_iunlink_resolve_bucket function within XFS's online filesystem repair code (fs/xfs/scrub/agheader_repair.c). The function reconstructs in-core unlinked inode list pointers but fails to detect cycles in the next_unlinked pointer chain, leading to infinite loops. The fix introduces a bitmap to track which inodes have already been visited during the traversal; if an inode is encountered twice, the loop is broken and the infinite loop is prevented. The vulnerability affects Linux kernel versions 6.10 and later where this repair code was introduced. No CVSS score was assigned as this is a bug fix in a filesystem repair utility rather than a remotely exploitable security flaw.
Affected products
- Linux Linux kernel 6.10 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched