« Volver al listado

CVE-2026-97549

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix under-reservation of blocks when repairing sf directories

Whilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS="-n size=8192", I observed the following (trimmed) dmesg splat:

This is a consequence of commit 0fe77e57588b98, which added the following assertion to xfs_da_grow_inode_int:

Tracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args object that's passed to xfs_dir2_sf_to_block sets args->total to 1. This is incorrect because mkfs set the directory block size to 8k and the filesystem block size to 4k. In other words, args->total should be 2 here, not 1.

Leer descripción completaMostrar menos

Dave Chinner tripped over the same problem with the same branch through a different channel -- his test setup set the fs block size to 1k, in which case the directory block size is still set to 4k. Here, args->total should be 4.

Changing the assignment of args->total to sc->mp->m_dir_geo->fsbcount makes the assertion go away, but that isn't a complete fix. In xrep_tempexch_estimate, we also incorrectly assume that a shortform conversion requires 1 fsblock when it should be m_dir_geo->fsbcount. Without that, we can under-reserve space in the transaction and cause a filesystem shutdown.

Note that the xfs_dabuf_nfsb helper will compute the correct value for directories and xattr, so we use that instead of open-coding the logic. Also fix xrep_xattr_swap_prep to assign args->total via xfs_dabuf_nfsb to avoid one logic bomb if we ever support multi-fsblock attrs.

Tripped-by: 0fe77e57588b98 ("xfs: assert the reservation covers each da fork growth")

Detalles técnicos trazas, registros y código del informe original
 XFS: Assertion failed: args->total >= dp->i_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387
 WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511
 CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G        W           7.3.0-rc2-djwx #rc2 PREEMPT(lazy)  6e418570b606a39783b0e7e7b30dc407b965f9e8
 Tainted: [W]=WARN
 RIP: 0010:assfail+0x46/0x4a [xfs]
 RSP: 0018:ffffc900010d7890 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1
 RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38
 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
 R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940
 R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0
 FS:  00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0
 Call Trace:
  <TASK>
  xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
  __x64_sys_ioctl+0x76/0xc0
  do_syscall_64+0x7a/0x3b0
  entry_SYSCALL_64_after_hwframe+0x4b/0x53

 ASSERT(args->total >= dp->i_nblocks - nblks);

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97549",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
              "lessThan": "996cce0c422b66a0e8b1a99505f896b0669ee5b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
              "lessThan": "b8f46ca5cbd629ffb91489ad7f970b3837835b0a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
              "lessThan": "b950e84acd072ac648ace4fea53c0b1212da4b2c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
              "lessThan": "4d3c07591534517c633945c8d8e6526f10e3fabc",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/xfs/libxfs/xfs_da_btree.c",
            "fs/xfs/libxfs/xfs_da_btree.h",
            "fs/xfs/scrub/attr_repair.c",
            "fs/xfs/scrub/dir_repair.c",
            "fs/xfs/scrub/tempfile.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/xfs/libxfs/xfs_da_btree.c",
            "fs/xfs/libxfs/xfs_da_btree.h",
            "fs/xfs/scrub/attr_repair.c",
            "fs/xfs/scrub/dir_repair.c",
            "fs/xfs/scrub/tempfile.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:05.290",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4d3c07591534517c633945c8d8e6526f10e3fabc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/996cce0c422b66a0e8b1a99505f896b0669ee5b6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8f46ca5cbd629ffb91489ad7f970b3837835b0a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b950e84acd072ac648ace4fea53c0b1212da4b2c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix under-reservation of blocks when repairing sf directories\n\nWhilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS=\"-n\nsize=8192\", I observed the following (trimmed) dmesg splat:\n\n XFS: Assertion failed: args->total >= dp->i_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387\n WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511\n CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G        W           7.3.0-rc2-djwx #rc2 PREEMPT(lazy)  6e418570b606a39783b0e7e7b30dc407b965f9e8\n Tainted: [W]=WARN\n RIP: 0010:assfail+0x46/0x4a [xfs]\n RSP: 0018:ffffc900010d7890 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1\n RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38\n RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000\n R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940\n R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0\n FS:  00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0\n Call Trace:\n  <TASK>\n  xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x7a/0x3b0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThis is a consequence of commit 0fe77e57588b98, which added the\nfollowing assertion to xfs_da_grow_inode_int:\n\n ASSERT(args->total >= dp->i_nblocks - nblks);\n\nTracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args\nobject that's passed to xfs_dir2_sf_to_block sets args->total to 1.\nThis is incorrect because mkfs set the directory block size to 8k and\nthe filesystem block size to 4k.  In other words, args->total should be\n2 here, not 1.\n\nDave Chinner tripped over the same problem with the same branch through\na different channel -- his test setup set the fs block size to 1k, in\nwhich case the directory block size is still set to 4k.  Here,\nargs->total should be 4.\n\nChanging the assignment of args->total to sc->mp->m_dir_geo->fsbcount\nmakes the assertion go away, but that isn't a complete fix.  In\nxrep_tempexch_estimate, we also incorrectly assume that a shortform\nconversion requires 1 fsblock when it should be m_dir_geo->fsbcount.\nWithout that, we can under-reserve space in the transaction and cause a\nfilesystem shutdown.\n\nNote that the xfs_dabuf_nfsb helper will compute the correct value for\ndirectories and xattr, so we use that instead of open-coding the logic.\nAlso fix xrep_xattr_swap_prep to assign args->total via xfs_dabuf_nfsb\nto avoid one logic bomb if we ever support multi-fsblock attrs.\n\nTripped-by: 0fe77e57588b98 (\"xfs: assert the reservation covers each da fork growth\")"
    }
  ],
  "lastModified": "2026-10-03T11:18:03.050",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}