{"id":"CVE-2026-98447","kind":"vulnerability","aliases":["CVE-2026-98447"],"related":[],"title":"Linux kernel XFS: rtrefcount btree root formatting overruns memory buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots\n\nLOLLM noticed that the inode btree root formatting methods copy too many\nbytes -- there's only one set of keys in node blocks, not two.  This\ncauses memory corruption of whatever's beyond the buffers.","summary":"In the Linux kernel's XFS filesystem, formatting on-disk rtrefcount btree roots copies too many bytes, writing past the end of the buffers. An attacker may be able to corrupt kernel memory, but the sources do not say how it can be triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted","xfs"],"not_affected_if":["no-xfs-filesystems"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel in the NVD entry.\n- Check whether XFS is in use with `findmnt -t xfs` and whether real-time volumes are configured with `xfs_info` on the mount point.","fix":"- Update the Linux kernel to a release that includes the upstream fix for this CVE (fixed version unknown from the sources).","status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:27+00:00","updated_at":"2026-10-25T05:27:27+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:27:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for this CVE (fixed version unknown from the sources).","reach":"unknown","title":"Linux kernel XFS: rtrefcount btree root formatting overruns memory buffers","impact":"high","summary":"In the Linux kernel's XFS filesystem, formatting on-disk rtrefcount btree roots copies too many bytes, writing past the end of the buffers. An attacker may be able to corrupt kernel memory, but the sources do not say how it can be triggered.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","xfs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel memory corruption, possibly leading to crash or privilege escalation","analyst_note":"Find the fixed kernel versions and whether XFS real-time refcount triggers need root or a mounted rt volume, using the NVD entry and the upstream kernel commit.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel in the NVD entry.\n- Check whether XFS is in use with `findmnt -t xfs` and whether real-time volumes are configured with `xfs_info` on the mount point.","needs_analyst":true,"not_affected_if":["no-xfs-filesystems"],"who_is_affected":"Systems running a Linux kernel with XFS, especially those using XFS real-time volumes, since the bug is in the rtrefcount btree code. Hosts that do not mount XFS filesystems are unlikely to be affected. The sources do not say which kernel versions are vulnerable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":3337,"output_tokens":610,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98447':13A,16A 'abl':54B 'access':84C 'attack':51B 'beyond':123C 'block':113C 'btree':5A,37B,89C,96C 'buffer':10A,49B,125C 'byte':42B,103C 'caus':117C 'copi':39B,100C 'corrupt':56B,119C 'cve':11A,14A 'disk':35B 'end':46B 'filesystem':31B 'fix':81C 'follow':75C 'format':7A,32B,86C,98C 'host':23B 'infrastructur':17B 'inod':95C 'kernel':2A,20B,28B,57B,73C 'key':110C 'linux':1A,19B,27B,72C 'linux-kernel':18B 'lollm':91C 'mani':41B,102C 'may':52B 'memcpi':83C 'memori':9A,58B,118C 'method':99C 'node':112C 'notic':92C 'on-disk':33B 'ondisk':87C 'one':107C 'overrun':8A 'past':44B 'resolv':79C 'root':6A,38B,90C,97C 'rtrefcount':4A,36B,88C 'say':64B 'self':22B 'self-host':21B 'set':108C 'sourc':61B 'trigger':69B 'two':115C 'vulner':76C 'whatev':121C 'wild':82C 'write':43B 'xfs':3A,24B,30B,80C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with XFS, especially those using XFS real-time volumes, since the bug is in the rtrefcount btree code. Hosts that do not mount XFS filesystems are unlikely to be affected. The sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98447","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-19T10:18:53+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}