CVE-2026-64600

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64600", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.799Z", "datePublished": "2026-07-23T05:46:56.149Z", "dateUpdated": "2026-10-19T20:48:43.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:58:23.073Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/xfs_reflink.c"], "versions": [{"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "dc11be133efca5fe3a2fb02b016dee825cc12f18", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "b8c9aa832b52680ee40d6cab0efb081f9a69df05", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "50f0012da1040f69a4e788cd9aed587c9a04983f", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "e705d81a7193dd19e69b8e2bad4696d78a4ea075", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "206c09b04dc5469c7ff14d8aceff2d47c88078d9", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "44f891bc088958399eec27f7604928694aa35581", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/xfs_reflink.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18"}, {"url": "https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05"}, {"url": "https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f"}, {"url": "https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075"}, {"url": "https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9"}, {"url": "https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581"}, {"url": "https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7"}, {"url": "https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"}], "title": "xfs: resample the data fork mapping after cycling ILOCK", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/22/14"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/22/18"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/22/19"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/31/3"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/03/4"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/03/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-03T20:31:20.507Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64600", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:43:31.132977Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:48:43.886Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64600", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.799Z", "datePublished": "2026-07-23T05:46:56.149Z", "dateUpdated": "2026-10-19T20:48:43.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:58:23.073Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/xfs_reflink.c"], "versions": [{"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "dc11be133efca5fe3a2fb02b016dee825cc12f18", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "b8c9aa832b52680ee40d6cab0efb081f9a69df05", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "50f0012da1040f69a4e788cd9aed587c9a04983f", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "e705d81a7193dd19e69b8e2bad4696d78a4ea075", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "206c09b04dc5469c7ff14d8aceff2d47c88078d9", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "44f891bc088958399eec27f7604928694aa35581", "status": "affected", "versionType": "git"}, {"version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "lessThan": "2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/xfs_reflink.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18"}, {"url": "https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05"}, {"url": "https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f"}, {"url": "https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075"}, {"url": "https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9"}, {"url": "https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581"}, {"url": "https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7"}, {"url": "https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"}], "title": "xfs: resample the data fork mapping after cycling ILOCK", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/22/14"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/22/18"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/22/19"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/31/3"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/03/4"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/03/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-03T20:31:20.507Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64600", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:43:31.132977Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:43:31.824Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/xfs/xfs_reflink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dc11be133efca5fe3a2fb02b016dee825cc12f18", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}, {"lessThan": "b8c9aa832b52680ee40d6cab0efb081f9a69df05", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}, {"lessThan": "50f0012da1040f69a4e788cd9aed587c9a04983f", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}, {"lessThan": "e705d81a7193dd19e69b8e2bad4696d78a4ea075", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}, {"lessThan": "206c09b04dc5469c7ff14d8aceff2d47c88078d9", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}, {"lessThan": "44f891bc088958399eec27f7604928694aa35581", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}, {"lessThan": "2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7", "status": "affected", "version": "3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/xfs/xfs_reflink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3818D739-E248-44DF-A565-067AAC0189C5", "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*", "matchCriteriaId": "D6ECA620-8606-4230-A87D-3FF3EFE12592", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle."}], "id": "CVE-2026-64600", "lastModified": "2026-10-19T21:17:49.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64600", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:43:31.132977Z", "version": "2.0.3"}}]}, "published": "2026-07-23T06:16:50.493", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Exploit", "Third Party Advisory"], "url": "https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/07/22/14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/07/22/18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/07/22/19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/07/31/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/08/03/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2026/08/03/8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:39494", "cpe": "cpe:/o:redhat:enterprise_linux:10.2", "package": "kernel-0:6.12.0-211.34.1.el10_2", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2026-07-14T00:00:00Z"}, {"advisory": "RHSA-2026:41062", "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0", "package": "kernel-0:6.12.0-55.89.1.el10_0", "product_name": "Red Hat Enterprise Linux 10.0 Extended Update Support", "release_date": "2026-07-16T00:00:00Z"}, {"advisory": "RHSA-2026:39180", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.144.1.rt7.485.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2026-07-14T00:00:00Z"}, {"advisory": "RHSA-2026:39179", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.144.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2026-07-14T00:00:00Z"}, {"advisory": "RHSA-2026:39984", "cpe": "cpe:/o:redhat:rhel_aus:8.4", "package": "kernel-0:4.18.0-305.198.1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2026-07-15T00:00:00Z"}, {"advisory": "RHSA-2026:39984", "cpe": "cpe:/o:redhat:rhel_eus_long_life:8.4", "package": "kernel-0:4.18.0-305.198.1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "release_date": "2026-07-15T00:00:00Z"}, {"advisory": "RHBA-2026:41254", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.202.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2026-07-17T00:00:00Z"}, {"advisory": "RHBA-2026:41254", "cpe": "cpe:/o:redhat:rhel_eus_long_life:8.6", "package": "kernel-0:4.18.0-372.202.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "release_date": "2026-07-17T00:00:00Z"}, {"advisory": "RHSA-2026:41229", "cpe": "cpe:/o:redhat:rhel_tus:8.8", "package": "kernel-0:4.18.0-477.154.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "release_date": "2026-07-17T00:00:00Z"}, {"advisory": "RHSA-2026:41229", "cpe": "cpe:/o:redhat:rhel_e4s:8.8", "package": "kernel-0:4.18.0-477.154.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "release_date": "2026-07-17T00:00:00Z"}, {"advisory": "RHBA-2026:39332", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-687.26.1.el9_8", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2026-07-14T00:00:00Z"}, {"advisory": "RHBA-2026:39332", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-687.26.1.el9_8", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2026-07-14T00:00:00Z"}, {"advisory": "RHBA-2026:41013", "cpe": "cpe:/a:redhat:rhel_e4s:9.2", "package": "kernel-0:5.14.0-284.182.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "release_date": "2026-07-16T00:00:00Z"}, {"advisory": "RHSA-2026:41063", "cpe": "cpe:/a:redhat:rhel_e4s:9.4", "package": "kernel-0:5.14.0-427.138.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "release_date": "2026-07-16T00:00:00Z"}, {"advisory": "RHSA-2026:40425", "cpe": "cpe:/a:redhat:rhel_eus:9.6", "package": "kernel-0:5.14.0-570.128.1.el9_6", "product_name": "Red Hat Enterprise Linux 9.6 Extended Update Support", "release_date": "2026-07-16T00:00:00Z"}], "bugzilla": {"description": "kernel: XFS data corruption using reflink", "id": "2498915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498915"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["A flaw was found in the XFS filesystem. A race condition in the copy-on-write mechanism for reflinked files can cause writes to bypass the copy-on-write process and modify shared data blocks directly. As a result, data intended for a private copy may be written to the original shared location, corrupting the contents of other files that reference those blocks. A local attacker with read access to a file on an XFS filesystem with reflink enabled could exploit this flaw to corrupt files they do not have write access to, allowing content to be added to the target file. If properly exploited this vulnerability may lead to privilege escalations or arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n1. Install and configure SystemTap\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n2. Create the mitigation script\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n~~~\nprobe begin {\nprintf(\"refluxfs mitigation loaded\\n\")\n}\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n$remap_flags = 0xffff\n}\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n$return = -95\n}\nprobe end {\nprintf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n3. Load the mitigation\nAs the `root` user, execute SystemTap in guru mode:\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\nOnce the script is compiled and loaded, the following message will appear:\n~~~\nrefluxfs mitigation loaded\n~~~\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\nImportant considerations:\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}, "name": "CVE-2026-64600", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}], "public_date": "2026-07-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64600\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64600"], "statement": "This flaw affects XFS filesystems that have the reflink feature enabled (reflink=1), which is the default configuration for XFS filesystems created on Red Hat Enterprise Linux 8 and later. The issue is a race condition where internal file mapping information becomes stale during a lock cycle but is not refreshed before being used to determine whether data blocks are shared between files. Exploitation requires local access and read permission to the target file. Systems using XFS without reflink enabled, or using other filesystems such as ext4, are not affected. Red Hat Enterprise Linux 7 and earlier are not affected, as the reflink feature is not available on those versions.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5,e705d81a7193dd19e69b8e2bad4696d78a4ea075)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5,206c09b04dc5469c7ff14d8aceff2d47c88078d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5,44f891bc088958399eec27f7604928694aa35581)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5,2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-23T09:30:16.625683+00:00", "updated": "2026-08-03T23:00:04.923860+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}