---
id: "CVE-2026-98872"
kind: "vulnerability"
aliases: ["CVE-2026-98872"]
title: "Linux freevxfs: malformed disk image crashes kernel via FIBMAP ioctl"
severity: "unknown"
cvss: null
epss: 0.00215
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["freevxfs", "linux-kernel", "other", "self-hosted"]
not_affected_if: ["freevxfs-not-loaded"]
published_at: "2026-10-23T12:18:20+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98872", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98872", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Linux freevxfs: malformed disk image crashes kernel via FIBMAP ioctl

The freevxfs driver in the Linux kernel calls BUG() when a typed extent on disk has an unrecognized type value, which halts the kernel. A local user who can trigger the ioctl(FIBMAP) call on a regular file on such a filesystem can crash the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release containing the upstream commit that replaces the BUG() with WARN_ON_ONCE() in fs/freevxfs/vxfs_bmap.c; the sources do not name the fixed version.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98872
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98872

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

freevxfs: don't BUG() on unknown typed-extent type

vxfs_bmap_typed() handles four typed-extent types and calls BUG() in
its default case, so an on-disk typed extent with any other type value
crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular
file:

  kernel BUG at fs/freevxfs/vxfs_bmap.c:230!
  RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline]
       vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257

Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value
vxfs_bmap_typed() already returns on failure (and from the DEV4 case
above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_