Live › vulnerability › CVE-2026-98872
Go to dashboardThe freevxfs driver in the Linux kernel calls BUG() when a typed extent on disk has an unrecognized type value, which halts the kernel. A local user who can trigger the ioctl(FIBMAP) call on a regular file on such a filesystem can crash the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the freevxfs driver built or loaded that can mount or access VxFS filesystems. Systems that do not use VxFS or have the freevxfs module disabled can skip it; the sources do not say more.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
freevxfs: don't BUG() on unknown typed-extent type
vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file:
kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257
Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.
This page as .md · .json · in your agent: get_signal("CVE-2026-98872")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.