CVE-2026-97548 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
The _maxlevels_ondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount versions of these functions forget to account for the inode root, which means that we could access beyond the end of the cursor given a sufficiently large btree. Fix this.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's XFS filesystem implementation contained a critical logic error within the rtrmap and rtrefcount metadata structures, specifically affecting how in-memory B-tree cursors are sized during initialization. These _maxlevels_ondisk functions serve as foundational components for determining the depth of B-trees used to manage reverse mapping information and realtime extent reference counts. The primary technical flaw lies in the calculation logic which failed to account for the inode root block when computing the maximum number of levels required for these specific B-tree structures. In XFS, metadata is organized hierarchically using B-trees where leaf nodes store actual data pointers or records, while internal nodes facilitate navigation through the tree structure. The root node often resides directly within the inode itself if the tree is small enough, but as the filesystem grows and more extents are allocated, additional levels of indirection become necessary to maintain efficient access patterns without excessive disk I/O operations.
This oversight creates a scenario where the kernel allocates insufficient memory for the cursor structures used during B-tree traversal and modification operations. When an XFS volume reaches a size or complexity that necessitates deeper B-trees, the system may attempt to traverse levels that were not properly reserved in the allocated cursor buffer. This results in out-of-bounds memory access, which falls under the Common Weakness Enumeration category CWE-125: Out-of-bounds Read. Such an error can lead to unpredictable kernel behavior depending on what data resides immediately adjacent to the allocated cursor structure in physical memory. In many cases, this manifests as a kernel panic or system crash due to invalid pointer dereferences or corrupted stack frames. However, under specific conditions involving crafted filesystem images or maliciously constructed metadata blocks, this vulnerability could potentially be exploited for information disclosure by reading sensitive kernel memory contents that lie beyond the intended buffer boundaries.
The operational impact of this vulnerability is primarily centered on system stability and availability rather than direct privilege escalation through traditional means. An attacker with local access who can trigger operations involving large reverse mapping or realtime extent reference count updates might induce a denial-of-service condition by crashing the host kernel. This affects all systems running affected versions of the Linux kernel that utilize XFS filesystems, particularly those managing large volumes with extensive file allocations where B-tree depth exceeds the miscalculated threshold. The vulnerability highlights the importance of accurate boundary calculations in low-level storage subsystem code, as errors here bypass higher-level security checks and operate directly within the privileged kernel space.
Mitigation strategies involve applying the upstream Linux kernel patches that correct the _maxlevels_ondisk calculation logic to include the inode root level for both rtrmap and rtrefcount structures. System administrators should ensure their distributions are updated with these fixes, which have been integrated into stable kernel releases following discovery by LOLLM researchers. From a defensive posture perspective, organizations relying on XFS should monitor for kernel updates addressing this specific flaw in metadata handling functions. Additionally, enabling Kernel Address Sanitizer (KASAN) or similar debugging tools during development and testing phases can help detect such out-of-bounds access issues before they reach production environments. While no known ATT&CK techniques directly target this specific code path exclusively, the resulting denial of service aligns with T1499: Endpoint Denial of Service within the MITRE ATT&CK framework for Linux systems. Maintaining strict patch management policies and verifying kernel version integrity against vendor advisories remains the most effective defense against exploitation attempts leveraging this memory safety violation.