CVE-2026-64600

xfs: resample the data fork mapping after cycling ILOCK

State: Published
Severity: 7.8 High
Published: Jul 23, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: resample the data fork mapping after cycling ILOCK

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared.

If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before dc11be133efca5fe3a2fb02b016dee825cc12f18Affected 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before b8c9aa832b52680ee40d6cab0efb081f9a69df05Affected 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 50f0012da1040f69a4e788cd9aed587c9a04983fAffected 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before e705d81a7193dd19e69b8e2bad4696d78a4ea075Affected 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 206c09b04dc5469c7ff14d8aceff2d47c88078d9Affected 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 44f891bc088958399eec27f7604928694aa35581Affected 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before dc11be133efca5fe3a2fb02b016dee825cc12f18Affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before b8c9aa832b52680ee40d6cab0efb081f9a69df05Affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 50f0012da1040f69a4e788cd9aed587c9a04983fAffected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before e705d81a7193dd19e69b8e2bad4696d78a4ea075Affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 206c09b04dc5469c7ff14d8aceff2d47c88078d9Affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 44f891bc088958399eec27f7604928694aa35581Affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 to before 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.