CVE-2026-64357 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchmaps reservation limit check
xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added.
The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the XFS filesystem implementation in the Linux kernel where a critical flaw occurs during the exchange maps operation. The issue stems from an improper handling of block reservation calculations that can lead to potential resource exhaustion or denial of service conditions. The problem manifests when xfs_exchmaps_estimate_overhead() function attempts to account for both bmbt and rmapbt overhead by adding these values to a local resblks variable, but fails to properly validate the final computed value against the established reservation limits.
The technical flaw occurs at the boundary between calculation and validation phases within the XFS transaction management system. When the function computes the total block requirements including overhead, it correctly stores this updated value back into req->resblks for later use in xfs_trans_alloc(). However, the UINT_MAX limit check is performed against the original req->resblks value before the overhead was added, rather than against the computed final value. This discrepancy allows a malicious actor to potentially bypass the intended reservation limits by exploiting this validation gap.
The operational impact of this vulnerability extends beyond simple resource management concerns as it can affect system stability and availability. When the block reservation limit check fails to properly validate the computed value, the system may allocate more resources than intended or fail to properly enforce existing limits that protect against excessive memory consumption during filesystem operations. This could result in denial of service conditions where legitimate operations are prevented from completing due to resource exhaustion, or conversely, allow unauthorized resource consumption that impacts overall system performance.
The vulnerability directly relates to CWE-129 and CWE-131 categories within the Common Weakness Enumeration framework, specifically addressing issues related to improper input validation and insufficient resource management. It also aligns with ATT&CK technique T1499.001 which covers resource exhaustion attacks, as the flaw could enable adversaries to consume excessive system resources through manipulated block reservation calculations. The mitigation strategy involves ensuring that all computed values are validated against established limits before being passed to critical system functions, particularly those involving unsigned integer parameters where overflow conditions could occur.
This fix specifically addresses a critical validation gap in the XFS filesystem's transaction management subsystem where the reservation limit check was incorrectly applied to an outdated value rather than the final computed result. The resolution ensures that xfs_trans_alloc() receives properly validated block reservation values that correctly respect the established UINT_MAX limits, thereby preventing potential resource exhaustion scenarios and maintaining system stability during filesystem operations involving exchange maps functionality.