Executive brief
A flaw in the Linux kernel's XFS filesystem growfs operation can mask I/O, memory allocation, and data corruption errors when loading realtime group inodes. This allows filesystem expansion to proceed as though critical operations succeeded, potentially leading to filesystem corruption, data loss, or operational failures during storage provisioning.
Technical details
The vulnerability exists in xfs_rtginode_ensure() function in fs/xfs/xfs_rtalloc.c, which incorrectly treats all xfs_rtginode_load() errors except -ENOENT as success by returning 0. This masks I/O errors, memory allocation failures, and filesystem corruption errors, leaving the realtime group inode unset while growfs proceeds. The fix changes the error handling to return all errors other than -ENOENT to the caller, allowing proper error propagation. The vulnerability affects the XFS realtime group inode creation path during filesystem growth operations. No user interaction is required; the condition triggers during growfs operations with an error condition present.
Affected products
- Linux Linux kernel affected versions include stable kernels from Linux 4.x through 6.x
Timeline
- 2026-08-26: disclosed: NVD published
- 2026-07-20: patched: Fix merged upstream (commit b7e53968cb8882c2d276429ea8550848a4940874)
- 2026-08-23: patched: Fix backported to stable tree (commit 61c5165f02deb2eed9b6b539bb279e6629fee652)