{"id":"CVE-2026-64600","revision":"216e809e1c184ed7a30a54114d34cecc","records":[{"revision":"216e809e1c184ed7a30a54114d34cecc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64600","aliases":[],"title":"xfs: resample the data fork mapping after cycling ILOCK","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping.  Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK.  Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping.  Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.","state":0,"publishedAt":"2026-07-23T05:46:56.149+00:00","modifiedAt":"2026-10-19T20:48:43.886+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/xfs_reflink.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"dc11be133efca5fe3a2fb02b016dee825cc12f18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"b8c9aa832b52680ee40d6cab0efb081f9a69df05\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"50f0012da1040f69a4e788cd9aed587c9a04983f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"e705d81a7193dd19e69b8e2bad4696d78a4ea075\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"206c09b04dc5469c7ff14d8aceff2d47c88078d9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"44f891bc088958399eec27f7604928694aa35581\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5\",\n                            \"lessThan\": \"2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/xfs_reflink.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.96\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18","https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05","https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f","https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075","https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9","https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581","https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7","https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64600","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64600","identifiers":["CVE-2026-64600"]},"retained":false,"historicalAffected":[]}],"coverage":[]}