{"id":"CVE-2026-98872","kind":"vulnerability","aliases":["CVE-2026-98872"],"related":[],"title":"Linux freevxfs: malformed disk image crashes kernel via FIBMAP ioctl","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfreevxfs: don't BUG() on unknown typed-extent type\n\nvxfs_bmap_typed() handles four typed-extent types and calls BUG() in\nits default case, so an on-disk typed extent with any other type value\ncrashes the kernel. It is reachable from ioctl(FIBMAP) on a regular\nfile:\n\n  kernel BUG at fs/freevxfs/vxfs_bmap.c:230!\n  RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline]\n       vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257\n\nReplace the BUG() with WARN_ON_ONCE() and return 0 -- the value\nvxfs_bmap_typed() already returns on failure (and from the DEV4 case\nabove); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.","summary":"The freevxfs driver in the Linux kernel calls BUG() when a typed extent on disk has an unrecognized type value, which halts the kernel. A local user who can trigger the ioctl(FIBMAP) call on a regular file on such a filesystem can crash the machine.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freevxfs","linux-kernel","other","self-hosted"],"not_affected_if":["freevxfs-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release containing the upstream commit that replaces the BUG() with WARN_ON_ONCE() in fs/freevxfs/vxfs_bmap.c; the sources do not name the fixed version.","status":"open","published_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:17+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:00:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release containing the upstream commit that replaces the BUG() with WARN_ON_ONCE() in fs/freevxfs/vxfs_bmap.c; the sources do not name the fixed version.","reach":"local","title":"Linux freevxfs: malformed disk image crashes kernel via FIBMAP ioctl","impact":"low","summary":"The freevxfs driver in the Linux kernel calls BUG() when a typed extent on disk has an unrecognized type value, which halts the kernel. A local user who can trigger the ioctl(FIBMAP) call on a regular file on such a filesystem can crash the machine.","category":"other","nicknames":[],"who_cares":["linux-kernel","freevxfs","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel crashes with a BUG, causing denial of service on the host.","analyst_note":"Confirm the fixed kernel versions and whether the freevxfs driver is commonly enabled in distribution kernels, using the NVD entry linked in the sources.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["freevxfs-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the freevxfs driver built or loaded that can mount or access VxFS filesystems. Systems that do not use VxFS or have the freevxfs module disabled can skip it; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3559,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':146C '-2026':12A,15A '-98872':13A,16A '0':159C,178C '230':136C,142C '257':149C 'alreadi':165C 'bmap':92C,139C,163C 'bmap1':145C 'bug':33B,84C,102C,133C,152C 'call':32B,58B,101C 'case':106C,173C 'clean':185C 'crash':6A,68B,119C 'cve':11A,14A 'default':105C 'dev4':172C 'disk':4A,39B,111C 'driver':27B 'eio':180C 'extent':37B,89C,98C,113C 'fail':184C 'failur':168C 'fibmap':9A,57B,127C 'file':62B,131C 'filesystem':66B 'follow':76C 'four':95C 'freevxf':2A,17B,26B,81C 'fs/freevxfs/vxfs_bmap.c':135C,141C,148C 'getblk':176C 'halt':46B 'handl':94C 'host':24B 'imag':5A 'inlin':143C 'ioctl':10A,56B,126C,183C 'kernel':7A,20B,31B,48B,74C,121C,132C 'linux':1A,19B,30B,73C 'linux-kernel':18B 'local':50B 'machin':70B 'malform':3A 'map':177C 'on-disk':109C 'reachabl':124C 'regular':61B,130C 'replac':150C 'resolv':80C 'return':158C,166C 'rip':137C 'self':23B 'self-host':22B 'trigger':54B 'type':36B,43B,88C,90C,93C,97C,99C,112C,117C,140C,164C 'typed-ext':87C,96C 'unknown':86C 'unrecogn':42B 'user':51B 'valu':44B,118C,161C 'via':8A 'vulner':77C 'vxfs':91C,138C,144C,162C,175C 'warn':154C 'x128a/0x12d0':147C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the freevxfs driver built or loaded that can mount or access VxFS filesystems. Systems that do not use VxFS or have the freevxfs module disabled can skip it; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98872","severity":null,"published_at":"2026-10-23T12:18:20+00:00","modified_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98872","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98872","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}