Executive brief
XFS, a high-performance file system used in Linux, contains a boundary validation error in its realtime reference count index. A malicious or corrupted disk image with specially crafted metadata can trigger a memory access past the allocated buffer, crashing the system during mount or filesystem operations. This could be exploited to cause denial of service on systems mounting untrusted XFS filesystems.
Technical details
The vulnerability is an off-by-one validation error in xfs_rtrefcountbt_verify() and xfs_iformat_rtrefcount() that check the root level using ">" instead of ">=". This allows a crafted rtreflink image to specify a root level equal to m_rtrefc_maxlevels (when it should be strictly less). When xfs_rtrefcountbt_init_cursor() sets bc_nlevels = bb_level + 1, it exceeds bc_maxlevels by one, causing a heap buffer overflow in the xfs_rtrefcountbt_cur slab object. The overflow is triggered on the first btree operation after mount, typically during log/CoW recovery or FS_IOC_GETFSMAP operations. The fix changes the validation from ">" to ">=" to reject root levels equal to m_rtrefc_maxlevels, aligning with sibling verifiers for data-device refcount/rmap structures.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-26: disclosed