{"id":"CVE-2026-98975","kind":"vulnerability","aliases":["CVE-2026-98975"],"related":[],"title":"Linux kernel XFS: reflink flag handling lets writes corrupt shared file blocks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong.  A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything.  The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this.  Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore.  Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents.  Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it.","summary":"In the Linux kernel XFS filesystem, an exchange operation could clear the reflink flag while a file still shared blocks past its on-disk size. The next write to such a block happens in place instead of copy-on-write, which can corrupt the other file sharing that block.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","xfs"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:19+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:21+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:56:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel XFS: reflink flag handling lets writes corrupt shared file blocks","impact":"medium","summary":"In the Linux kernel XFS filesystem, an exchange operation could clear the reflink flag while a file still shared blocks past its on-disk size. The next write to such a block happens in place instead of copy-on-write, which can corrupt the other file sharing that block.","category":"infrastructure","nicknames":[],"who_cares":["linux","xfs","kernel"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Shared file data silently corrupted by in-place writes","analyst_note":"Check the kernel.org stable commits and the NVD entry for affected kernel version ranges and the fixed versions; the sources here give no versions or severity.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000568,"input_tokens":3848,"output_tokens":367,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98975':15A,18A '0':100C '1':230C '2':231C 'a23eca88448e':179C 'add':199C 'along':277C 'alreadi':211C,244C 'anoth':200C 'anymor':233C 'anyth':151C 'anyway':156C 'assum':110C 'assumpt':125C 'block':12A,42B,55B,73B,134C,164C 'carri':241C 'case':202C 'clear':33B,155C,187C,228C 'commit':178C 'copi':62B 'copy-on-writ':61B 'corrupt':9A,67B,171C 'could':32B 'cover':95C 'cow':170C,332C 'cve':13A,16A 'disk':47B,103C,137C 'e.g':139C 'enough':286C 'ensur':209C,299C 'eof':144C 'everi':111C 'exchang':30B,86C,90C,94C,107C,141C,183C,220C,289C 'exchange-rang':182C 'exchmap':208C,298C 'expect':342C 'extent':280C,313C 'falloc':351C 'file':11A,39B,70B,97C,123C,129C,174C 'filesystem':28B 'fix':181C,192C 'fl':352C 'flag':5A,36B,88C,109C,118C,153C,186C,206C,214C,270C,291C,319C,340C,347C 'follow':79C 'fork':333C 'format':254C 'front':295C 'hand':115C 'handl':6A 'happen':56B,165C 'ignor':258C 'infrastructur':19B 'ino':229C 'ino1':190C 'inod':217C,273C,293C,309C,324C,336C 'instanc':194C 'instead':59B,168C,325C 'intent':234C 'ioc':260C 'issu':188C 'keep':224C 'kernel':2A,20B,26B,77C,238C 'left':316C 'let':7A 'linux':1A,21B,25B,76C 'log':235C,253C 'make':327C 'map':91C,112C 'mask':245C,255C 'may':239C 'move':113C,204C,267C 'next':50B,159C 'noth':226C 'offset':99C 'older':237C 'on-disk':45B 'one':193C,272C,345C 'oper':31B 'past':43B,135C 'path':290C 'place':58B,167C 'problem':265C 'rang':142C,184C,354C 'rather':197C 'receiv':310C 'recoveri':243C 'reflink':4A,35B,87C,108C,117C,185C,210C,232C,269C,300C,339C 'remov':282C,362C 'resolv':83C 'scrub':356C 'set':145C,212C,227C,320C 'share':10A,41B,71B,133C,176C,312C 'sinc':334C 'size':48B,104C,138C,148C 'smaller':147C 'special':201C 'stay':250C,349C 'step':306C 'still':40B,131C,240C 'stop':85C,203C 'sure':328C 'swapext':261C,302C 'truncat':359C 'unmap':150C 'unshar':353C 'vulner':80C 'without':149C,317C 'would':314C 'write':8A,51B,64B,160C 'written':191C 'wrong':127C 'xfs':3A,22B,27B,84C,180C,207C,259C,297C,355C 'xmi':105C 'zero':361C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98975","severity":null,"published_at":"2026-10-23T13:17:19+00:00","modified_at":"2026-10-23T13:17:19+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98975","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98975","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}