SB20261023185 - Incorrect calculation in Linux kernel xfs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-98974)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt another file's contents by overwriting shared filesystem blocks without triggering copy-on-write.

The vulnerability exists due to incorrect file size calculations in the Linux kernel XFS exchange-range implementation when processing XFS_IOC_EXCHANGE_RANGE operations with the TO_EOF flag and nonzero offsets on a filesystem supporting reflink and exchange-range. A local user can perform a sequence of file range exchanges that leaves shared blocks beyond the reported end of a file and incorrectly clears its reflink flag, then extend that file with a write to modify blocks still shared with another file.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7dfb218c829c1acb626e0fe92c5fddb9a26a03e9
• https://git.kernel.org/stable/c/952b5c99a840c2bff1f6645fd5e06e1db6ec2623
• https://git.kernel.org/stable/c/b361d32b884f8ddcb9bad5d99b69eece648f8e43
• https://git.kernel.org/stable/c/cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8