CVE-2026-97551

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97551", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.154Z", "datePublished": "2026-09-25T10:21:44.048Z", "dateUpdated": "2026-10-19T09:09:14.354Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:14.354Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: initialise args->total for parent pointer updates\n\nxfs_parent_da_args_init() builds an xfs_da_args from a zeroed\nxfs_parent_args (kmem_cache_zalloc), leaving args->total == 0.\nxfs_da_grow_inode_int() treats that field as a running block reservation\nand subtracts from it; because it is an xfs_extlen_t (uint32_t), the\nfirst attr-fork growth wraps it to ~0U. That defeats the free-space\ncheck in xfs_alloc_space_available(), and when it coincides with an AG\nthat has exactly zero available blocks the allocation is clamped to\nmaxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates\nto a filesystem shutdown.\n\nSet args->total the way the log recovery path does\n(xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace\npaths that can grow the fork. Removals and lookups never grow it, so\nthey leave the field alone, matching that switch."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/libxfs/xfs_parent.c"], "versions": [{"version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "lessThan": "9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1", "status": "affected", "versionType": "git"}, {"version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "lessThan": "c66e138af626cad4210da449996ae9e07ee63add", "status": "affected", "versionType": "git"}, {"version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "lessThan": "ac9032882d673dd6679e1d873a2dc0131a1aeb43", "status": "affected", "versionType": "git"}, {"version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "lessThan": "8e4ebb6afaa34bd2e8ce52da231003d24111c2d6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/libxfs/xfs_parent.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1"}, {"url": "https://git.kernel.org/stable/c/c66e138af626cad4210da449996ae9e07ee63add"}, {"url": "https://git.kernel.org/stable/c/ac9032882d673dd6679e1d873a2dc0131a1aeb43"}, {"url": "https://git.kernel.org/stable/c/8e4ebb6afaa34bd2e8ce52da231003d24111c2d6"}], "title": "xfs: initialise args->total for parent pointer updates", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/xfs/libxfs/xfs_parent.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1", "status": "affected", "version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "versionType": "git"}, {"lessThan": "c66e138af626cad4210da449996ae9e07ee63add", "status": "affected", "version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "versionType": "git"}, {"lessThan": "ac9032882d673dd6679e1d873a2dc0131a1aeb43", "status": "affected", "version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "versionType": "git"}, {"lessThan": "8e4ebb6afaa34bd2e8ce52da231003d24111c2d6", "status": "affected", "version": "b7c62d90c12c6cc86f10b8a62cefe0029374b6ff", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/xfs/libxfs/xfs_parent.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: initialise args->total for parent pointer updates\n\nxfs_parent_da_args_init() builds an xfs_da_args from a zeroed\nxfs_parent_args (kmem_cache_zalloc), leaving args->total == 0.\nxfs_da_grow_inode_int() treats that field as a running block reservation\nand subtracts from it; because it is an xfs_extlen_t (uint32_t), the\nfirst attr-fork growth wraps it to ~0U. That defeats the free-space\ncheck in xfs_alloc_space_available(), and when it coincides with an AG\nthat has exactly zero available blocks the allocation is clamped to\nmaxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates\nto a filesystem shutdown.\n\nSet args->total the way the log recovery path does\n(xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace\npaths that can grow the fork. Removals and lookups never grow it, so\nthey leave the field alone, matching that switch."}], "id": "CVE-2026-97551", "lastModified": "2026-10-19T10:17:24.117", "metrics": {}, "published": "2026-09-25T11:17:05.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e4ebb6afaa34bd2e8ce52da231003d24111c2d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ac9032882d673dd6679e1d873a2dc0131a1aeb43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c66e138af626cad4210da449996ae9e07ee63add"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xfs: initialise args->total for parent pointer updates", "id": "2541303", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541303"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxfs: initialise args->total for parent pointer updates\nxfs_parent_da_args_init() builds an xfs_da_args from a zeroed\nxfs_parent_args (kmem_cache_zalloc), leaving args->total == 0.\nxfs_da_grow_inode_int() treats that field as a running block reservation\nand subtracts from it; because it is an xfs_extlen_t (uint32_t), the\nfirst attr-fork growth wraps it to ~0U. That defeats the free-space\ncheck in xfs_alloc_space_available(), and when it coincides with an AG\nthat has exactly zero available blocks the allocation is clamped to\nmaxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates\nto a filesystem shutdown.\nSet args->total the way the log recovery path does\n(xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace\npaths that can grow the fork. Removals and lookups never grow it, so\nthey leave the field alone, matching that switch.", "A flaw was found in the Linux kernel's XFS file system. A local user can trigger a Denial of Service (DoS) by forcing an unexpected filesystem shutdown. When updating parent pointer attributes, the kernel fails to properly initialize the block reservation counter, causing an integer underflow during storage space allocation. Under constrained storage conditions, this miscalculation leads to an unhandled allocation error that forces the filesystem to shut down."], "name": "CVE-2026-97551", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97551\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97551\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97551.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b7c62d90c12c6cc86f10b8a62cefe0029374b6ff,9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b7c62d90c12c6cc86f10b8a62cefe0029374b6ff,c66e138af626cad4210da449996ae9e07ee63add)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b7c62d90c12c6cc86f10b8a62cefe0029374b6ff,ac9032882d673dd6679e1d873a2dc0131a1aeb43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b7c62d90c12c6cc86f10b8a62cefe0029374b6ff,8e4ebb6afaa34bd2e8ce52da231003d24111c2d6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:00:16.487461+00:00", "updated": "2026-10-01T11:45:07.601530+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}