CVE-2026-64600 Details
Description
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.
A race condition vulnerability has been identified in the Linux kernel's XFS filesystem, specifically in versions 4.11 and later. This vulnerability allows an unprivileged local user to overwrite the on-disk contents of any file they can read, on XFS filesystems with reflink support enabled. The issue arises from a flaw in the copy-on-write (CoW) allocation process, where concurrent direct I/O writes can be misdirected to the wrong physical blocks, leading to unintended modifications of files such as /etc/passwd or SUID-root binaries. The vulnerability was introduced in February 2017 and has been present in all mainline and stable kernels since then.
Users can update to the latest Linux kernel version, where this vulnerability has been patched. For those unable to immediately apply the patch, a temporary mitigation can be implemented using a SystemTap script that disables the reflink operation in XFS.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 7.2 rc1 7.2 rc2 7.2 rc3 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 3, 2026 | CVE Modified | CVE |
| Aug 3, 2026 | CVE Modified | CVE |
| Jul 31, 2026 | CVE Modified | CVE |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 24, 2026 | CVE Modified | kernel.org |
| Jul 24, 2026 | CVE Modified | kernel.org |
| Jul 23, 2026 | CVE Modified | CVE |
| Jul 23, 2026 | New CVE Received | kernel.org |