Executive brief
The Linux kernel's XFS file system has a vulnerability in how it validates attribute entries stored in leaf blocks. An attacker with the ability to craft a malicious XFS file system image could trigger an out-of-bounds memory read during file system validation, potentially causing a denial of service or information disclosure.
Technical details
The vulnerability exists in the xfs_attr3_leaf_verify_entry() function, which validates XFS attribute leaf block entries. The function accessed the namelen and valuelen fields of entry pointers (lentry/rentry) before verifying that these pointers themselves were within the buffer bounds. A crafted nameidx value pointing near the end of a buffer could cause field accesses to read memory beyond the buffer boundary before the later bounds check was performed. The fix adds explicit bounds validation using offsetof() to check that entry pointers and their flexible array members (nameval/name) are within bounds before any field access. The issue affects XFS code that has been present since v5.5, but requires the ability to provide a malicious file system image.
Affected products
- Linux Linux kernel 5.5 and later
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched