CVE-2026-98872

freevxfs: don't BUG() on unknown typed-extent type

Published Oct 23, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

freevxfs: don't BUG() on unknown typed-extent type

vxfs_bmap_typed() handles four typed-extent types and calls BUG() in
its default case, so an on-disk typed extent with any other type value
crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular
file:

kernel BUG at fs/freevxfs/vxfs_bmap.c:230!
RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline]
vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257

Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value
vxfs_bmap_typed() already returns on failure (and from the DEV4 case
above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fe40a19d571cbb584eea46038ee919d8712b2d2c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 500e9d5bf9eff2096a21b7ac25a0a06ca46ab821
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f1f2d54a576f0e4133b979e545abcfefd439c300
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7ada9807e37103b41f586d34e3075e1209182b65
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1284d687d46953fff9c0d969df108114611aca8b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 405f13d7b270913e06e8e2b4de568985f94ef7d6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 704d48d81dc41470e108811c32c577ada66192d4

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fe40a19d571cbb584eea46038ee919d8712b2d2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,500e9d5bf9eff2096a21b7ac25a0a06ca46ab821)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1f2d54a576f0e4133b979e545abcfefd439c300)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ada9807e37103b41f586d34e3075e1209182b65)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1284d687d46953fff9c0d969df108114611aca8b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,405f13d7b270913e06e8e2b4de568985f94ef7d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,704d48d81dc41470e108811c32c577ada66192d4)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fe40a19d571cbb584eea46038ee919d8712b2d2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,500e9d5bf9eff2096a21b7ac25a0a06ca46ab821)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1f2d54a576f0e4133b979e545abcfefd439c300)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ada9807e37103b41f586d34e3075e1209182b65)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1284d687d46953fff9c0d969df108114611aca8b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,405f13d7b270913e06e8e2b4de568985f94ef7d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,704d48d81dc41470e108811c32c577ada66192d4)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.213% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98872.mbox
https://git.kernel.org/stable/c/1284d687d46953fff9c0d969df108114611aca8b
https://git.kernel.org/stable/c/405f13d7b270913e06e8e2b4de568985f94ef7d6
https://git.kernel.org/stable/c/500e9d5bf9eff2096a21b7ac25a0a06ca46ab821
https://git.kernel.org/stable/c/704d48d81dc41470e108811c32c577ada66192d4
https://git.kernel.org/stable/c/7ada9807e37103b41f586d34e3075e1209182b65
https://git.kernel.org/stable/c/f1f2d54a576f0e4133b979e545abcfefd439c300
https://git.kernel.org/stable/c/fe40a19d571cbb584eea46038ee919d8712b2d2c
https://nvd.nist.gov/vuln/detail/CVE-2026-98872
https://www.cve.org/CVERecord?id=CVE-2026-98872

History

Oct 26, 2026 2:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-20

Oct 26, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98872.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98872 https://www.cve.org/CVERecord?id=CVE-2026-98872
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 23, 2026 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 2:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20

Oct 23, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG() on unknown typed-extent type vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file: kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257 Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.
Title		freevxfs: don't BUG() on unknown typed-extent type
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1284d687d46953fff9c0d969df108114611aca8b https://git.kernel.org/stable/c/405f13d7b270913e06e8e2b4de568985f94ef7d6 https://git.kernel.org/stable/c/500e9d5bf9eff2096a21b7ac25a0a06ca46ab821 https://git.kernel.org/stable/c/704d48d81dc41470e108811c32c577ada66192d4 https://git.kernel.org/stable/c/7ada9807e37103b41f586d34e3075e1209182b65 https://git.kernel.org/stable/c/f1f2d54a576f0e4133b979e545abcfefd439c300 https://git.kernel.org/stable/c/fe40a19d571cbb584eea46038ee919d8712b2d2c