CVE-2026-97552

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97552", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.154Z", "datePublished": "2026-09-25T10:21:44.651Z", "dateUpdated": "2026-10-19T09:09:15.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:15.341Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: initialise error in xfs_defer_finish_one()\n\nxfs_defer_finish_one() declares error without an initialiser and only\nassigns it inside the loop over dfp->dfp_work. When that list is empty\nthe loop body never runs, control falls through to the \"Done with the\ndfp, free it\" path, and the function returns an indeterminate value.\n\nAn item-less pending item reaches this through xfs_defer_add_barrier(),\nwhich xfs_reap_ag_blocks() uses on any CONFIG_XFS_ONLINE_REPAIR kernel.\nxfs_defer_finish_noroll() treats any non-EAGAIN return as fatal, so a\nnon-zero stack value turns a successful barrier into a\nSHUTDOWN_CORRUPT_INCORE in the middle of a repair. Zero is the correct\nresult: reaching the free path means the item loop drained without a\nnon-zero error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/libxfs/xfs_defer.c"], "versions": [{"version": "3f3cec031099c37513727efc978a12b6346e326d", "lessThan": "30748a24b9f04f9a83599ba907cc8fbff0729f3c", "status": "affected", "versionType": "git"}, {"version": "3f3cec031099c37513727efc978a12b6346e326d", "lessThan": "ba949a14446b7346e92e676ee3fe2bb79d9ce450", "status": "affected", "versionType": "git"}, {"version": "3f3cec031099c37513727efc978a12b6346e326d", "lessThan": "6b507c239884f7d4bf8339f6e9eb8bfcb540afde", "status": "affected", "versionType": "git"}, {"version": "3f3cec031099c37513727efc978a12b6346e326d", "lessThan": "6176d21d7bd609632c5b7e87a3adb9be29ec1e72", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/libxfs/xfs_defer.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/30748a24b9f04f9a83599ba907cc8fbff0729f3c"}, {"url": "https://git.kernel.org/stable/c/ba949a14446b7346e92e676ee3fe2bb79d9ce450"}, {"url": "https://git.kernel.org/stable/c/6b507c239884f7d4bf8339f6e9eb8bfcb540afde"}, {"url": "https://git.kernel.org/stable/c/6176d21d7bd609632c5b7e87a3adb9be29ec1e72"}], "title": "xfs: initialise error in xfs_defer_finish_one()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/xfs/libxfs/xfs_defer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "30748a24b9f04f9a83599ba907cc8fbff0729f3c", "status": "affected", "version": "3f3cec031099c37513727efc978a12b6346e326d", "versionType": "git"}, {"lessThan": "ba949a14446b7346e92e676ee3fe2bb79d9ce450", "status": "affected", "version": "3f3cec031099c37513727efc978a12b6346e326d", "versionType": "git"}, {"lessThan": "6b507c239884f7d4bf8339f6e9eb8bfcb540afde", "status": "affected", "version": "3f3cec031099c37513727efc978a12b6346e326d", "versionType": "git"}, {"lessThan": "6176d21d7bd609632c5b7e87a3adb9be29ec1e72", "status": "affected", "version": "3f3cec031099c37513727efc978a12b6346e326d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/xfs/libxfs/xfs_defer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: initialise error in xfs_defer_finish_one()\n\nxfs_defer_finish_one() declares error without an initialiser and only\nassigns it inside the loop over dfp->dfp_work. When that list is empty\nthe loop body never runs, control falls through to the \"Done with the\ndfp, free it\" path, and the function returns an indeterminate value.\n\nAn item-less pending item reaches this through xfs_defer_add_barrier(),\nwhich xfs_reap_ag_blocks() uses on any CONFIG_XFS_ONLINE_REPAIR kernel.\nxfs_defer_finish_noroll() treats any non-EAGAIN return as fatal, so a\nnon-zero stack value turns a successful barrier into a\nSHUTDOWN_CORRUPT_INCORE in the middle of a repair. Zero is the correct\nresult: reaching the free path means the item loop drained without a\nnon-zero error."}], "id": "CVE-2026-97552", "lastModified": "2026-10-19T10:17:24.207", "metrics": {}, "published": "2026-09-25T11:17:05.647", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/30748a24b9f04f9a83599ba907cc8fbff0729f3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6176d21d7bd609632c5b7e87a3adb9be29ec1e72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b507c239884f7d4bf8339f6e9eb8bfcb540afde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba949a14446b7346e92e676ee3fe2bb79d9ce450"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xfs: initialise error in xfs_defer_finish_one()", "id": "2541119", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541119"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxfs: initialise error in xfs_defer_finish_one()\nxfs_defer_finish_one() declares error without an initialiser and only\nassigns it inside the loop over dfp->dfp_work. When that list is empty\nthe loop body never runs, control falls through to the \"Done with the\ndfp, free it\" path, and the function returns an indeterminate value.\nAn item-less pending item reaches this through xfs_defer_add_barrier(),\nwhich xfs_reap_ag_blocks() uses on any CONFIG_XFS_ONLINE_REPAIR kernel.\nxfs_defer_finish_noroll() treats any non-EAGAIN return as fatal, so a\nnon-zero stack value turns a successful barrier into a\nSHUTDOWN_CORRUPT_INCORE in the middle of a repair. Zero is the correct\nresult: reaching the free path means the item loop drained without a\nnon-zero error.", "A flaw was found in the Linux kernel's XFS file system. An uninitialized variable in the deferred operation handling routine can cause the kernel to return an indeterminate value when processing empty work items during online repair. A local user initiating or interacting with file system repair operations could cause the system to misinterpret uninitialized memory as an in-core corruption error, leading to an unexpected file system shutdown and a denial of service (DoS)."], "name": "CVE-2026-97552", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97552\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97552\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97552.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f3cec031099c37513727efc978a12b6346e326d,30748a24b9f04f9a83599ba907cc8fbff0729f3c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f3cec031099c37513727efc978a12b6346e326d,ba949a14446b7346e92e676ee3fe2bb79d9ce450)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f3cec031099c37513727efc978a12b6346e326d,6b507c239884f7d4bf8339f6e9eb8bfcb540afde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f3cec031099c37513727efc978a12b6346e326d,6176d21d7bd609632c5b7e87a3adb9be29ec1e72)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:00:16.487141+00:00", "updated": "2026-10-01T12:15:05.363984+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}