{"id":"CVE-2026-98446","kind":"vulnerability","aliases":["CVE-2026-98446"],"related":[],"title":"Linux kernel XFS: metadata reservation underflow corrupts free block count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't let hidden_space go negative in xfs_metafile_resv_init\n\nLOLLM points out that if the amount of fdblocks that we can reserve for\na metadata btree file goes below the space already used by that file,\nthen the hidden_space subtraction can underflow, causing\nxfs_dec_fdblocks to subtract a huge amount of space.  We never want the\ntarget to be less than the used sapce, so fix the logic that adjusts\ndblocks_avail downwards.\n\nAlso fix an error in the adjacent comment.","summary":"In the XFS filesystem code, reserving space for a metadata btree file can underflow a counter when the reservation falls below the space that file already uses. The bad subtraction makes the kernel release a huge amount of free space it does not have, which can corrupt filesystem accounting.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","xfs"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:27+00:00","updated_at":"2026-10-25T05:27:27+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:27:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel XFS: metadata reservation underflow corrupts free block count","impact":"medium","summary":"In the XFS filesystem code, reserving space for a metadata btree file can underflow a counter when the reservation falls below the space that file already uses. The bad subtraction makes the kernel release a huge amount of free space it does not have, which can corrupt filesystem accounting.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","xfs"],"confidence":0.5,"needs_auth":"unknown","worst_case":"filesystem free-space accounting corrupted; exploitability unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected kernel version ranges and whether an unprivileged user can trigger the underflow.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000524,"input_tokens":3407,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98446':13A,16A 'account':69B 'adjac':165C 'adjust':155C 'alreadi':46B,115C 'also':159C 'amount':57B,99C,135C 'avail':157C 'bad':49B 'block':9A 'btree':31B,109C 'caus':127C 'code':25B 'comment':166C 'corrupt':7A,67B 'count':10A 'counter':36B 'cve':11A,14A 'dblock':156C 'dec':129C 'downward':158C 'error':162C 'fall':40B 'fdblock':101C,130C 'file':32B,45B,110C,119C 'filesystem':24B,68B 'fix':151C,160C 'follow':75C 'free':8A,59B 'go':86C 'goe':111C 'hidden':84C,122C 'huge':56B,134C 'init':92C 'kernel':2A,17B,53B,73C 'less':145C 'let':83C 'linux':1A,18B,72C 'logic':153C 'lollm':93C 'make':51B 'metadata':4A,30B,108C 'metafil':90C 'negat':87C 'never':139C 'point':94C 'releas':54B 'reserv':5A,26B,39B,105C 'resolv':79C 'resv':91C 'runtim':19B 'sapc':149C 'space':27B,43B,60B,85C,114C,123C,137C 'subtract':50B,124C,132C 'target':142C 'underflow':6A,34B,126C 'use':47B,116C,148C 'vulner':76C 'want':140C 'xfs':3A,20B,23B,80C,89C,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98446","severity":null,"published_at":"2026-10-18T16:16:54+00:00","modified_at":"2026-10-19T10:18:53+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}