SB20260928385 - Integer underflow in Linux kernel xfs libxfs

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-97551)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in XFS parent pointer update handling when processing parent pointer add or replacement updates that grow the attribute fork. A local user can trigger a parent pointer update that grows the attribute fork to cause a denial of service.

Exploitation requires an allocation group with exactly zero available blocks.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8e4ebb6afaa34bd2e8ce52da231003d24111c2d6
• https://git.kernel.org/stable/c/9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1
• https://git.kernel.org/stable/c/ac9032882d673dd6679e1d873a2dc0131a1aeb43
• https://git.kernel.org/stable/c/c66e138af626cad4210da449996ae9e07ee63add