---
id: "CVE-2026-98447"
kind: "vulnerability"
aliases: ["CVE-2026-98447"]
title: "Linux kernel XFS: rtrefcount btree root formatting overruns memory buffers"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "self-hosted", "xfs"]
not_affected_if: ["no-xfs-filesystems"]
published_at: "2026-10-18T16:16:55+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:27:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98447", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel XFS: rtrefcount btree root formatting overruns memory buffers

In the Linux kernel's XFS filesystem, formatting on-disk rtrefcount btree roots copies too many bytes, writing past the end of the buffers. An attacker may be able to corrupt kernel memory, but the sources do not say how it can be triggered.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it against the fixed kernel in the NVD entry.
- Check whether XFS is in use with `findmnt -t xfs` and whether real-time volumes are configured with `xfs_info` on the mount point.

## Fix

- Update the Linux kernel to a release that includes the upstream fix for this CVE (fixed version unknown from the sources).

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98447

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots

LOLLM noticed that the inode btree root formatting methods copy too many
bytes -- there's only one set of keys in node blocks, not two.  This
causes memory corruption of whatever's beyond the buffers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_