CVE-2026-64600
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.
No public exploitation has been reported so far. A fixed version is available (see the table below).
Recommended action: Update to the fixed version listed for your distribution using the native package manager.
Affected & fixed versions by distribution
Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.
| Distribution | Package | Affected | Fixed version | Status |
|---|---|---|---|---|
| Red Hat:enterprise_linux:9::baseos | kernel | - | 0:5.14.0-687.26.1.el9_8 | fixed |
| Red Hat:rhel_e4s:9.2::baseos | kernel | - | 0:5.14.0-284.182.1.el9_2 | fixed |
| Red Hat:rhel_aus:8.6::baseos | kernel | - | 0:4.18.0-372.202.1.el8_6 | fixed |
| Red Hat:rhel_eus_long_life:8.6::baseos | kernel | - | 0:4.18.0-372.202.1.el8_6 | fixed |