CVE-2026-97549 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix under-reservation of blocks when repairing sf directories
Whilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS="-n size=8192", I observed the following (trimmed) dmesg splat:
XFS: Assertion failed: args->total >= dp->i_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387 WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511
CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G W 7.3.0-rc2-djwx #rc2 PREEMPT(lazy) 6e418570b606a39783b0e7e7b30dc407b965f9e8 Tainted: [W]=WARN
RIP: 0010:assfail+0x46/0x4a [xfs]
RSP: 0018:ffffc900010d7890 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1 RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940 R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0 FS: 00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0 Call Trace: <TASK> xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
__x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x7a/0x3b0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
This is a consequence of commit 0fe77e57588b98, which added the following assertion to xfs_da_grow_inode_int:
ASSERT(args->total >= dp->i_nblocks - nblks);
Tracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args object that's passed to xfs_dir2_sf_to_block sets args->total to 1. This is incorrect because mkfs set the directory block size to 8k and the filesystem block size to 4k. In other words, args->total should be 2 here, not 1.
Dave Chinner tripped over the same problem with the same branch through a different channel -- his test setup set the fs block size to 1k, in which case the directory block size is still set to 4k. Here, args->total should be 4.
Changing the assignment of args->total to sc->mp->m_dir_geo->fsbcount makes the assertion go away, but that isn't a complete fix. In xrep_tempexch_estimate, we also incorrectly assume that a shortform conversion requires 1 fsblock when it should be m_dir_geo->fsbcount. Without that, we can under-reserve space in the transaction and cause a filesystem shutdown.
Note that the xfs_dabuf_nfsb helper will compute the correct value for directories and xattr, so we use that instead of open-coding the logic. Also fix xrep_xattr_swap_prep to assign args->total via xfs_dabuf_nfsb to avoid one logic bomb if we ever support multi-fsblock attrs.
Tripped-by: 0fe77e57588b98 ("xfs: assert the reservation covers each da fork growth")
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel involves a critical logical error within the XFS filesystem implementation, specifically affecting the repair mechanisms for shortform directories. This issue manifests as an under-reservation of disk blocks during directory tree reconstruction and swapping operations. The root cause lies in incorrect calculations regarding file system block counts when converting between different internal data structures, particularly when transitioning from short-form to block-based directory formats or performing transactional exchanges. These miscalculations lead to insufficient space being reserved for filesystem metadata updates, which can trigger assertion failures during scrubbing processes and potentially result in a forced filesystem shutdown if the under-reservation occurs during active write transactions.
The technical flaw originates in how the kernel calculates the number of file system blocks required for directory operations when the directory block size differs from the underlying filesystem block size. In specific configurations, such as those where mkfs is invoked with non-standard sizes like an 8k directory block on a 4k filesystem block, or vice versa, the code incorrectly assumes that shortform conversions require only one file system block. This assumption fails to account for the actual ratio between directory geometry and filesystem geometry. Consequently, when functions such as xrep_dir_swap_prep and xrep_tempexch_estimate execute, they pass an incorrect total count of blocks to lower-level growth routines like xfs_da_grow_inode_int. This leads to a state where the allocated reservation is less than what is actually needed for the inode expansion, violating internal consistency checks embedded in the kernel source code.
From an operational perspective, this vulnerability primarily impacts system stability and data integrity during maintenance operations rather than through direct exploitation by external attackers. The immediate symptom observed is a kernel assertion failure within the xfs_da_btree.c module, which halts the execution of directory repair routines invoked via ioctl calls for metadata scrubbing. While this does not typically allow for remote code execution or privilege escalation in standard usage scenarios, it represents a significant reliability issue that can lead to denial of service conditions by forcing an unmount or shutdown of the filesystem if the under-reservation occurs during critical transactional phases outside of controlled testing environments. The vulnerability highlights risks associated with complex storage subsystem logic where assumptions about block sizes are not dynamically validated against actual geometry parameters.
This flaw aligns with CWE-20, Improper Input Validation, as it stems from a failure to correctly validate and compute resource requirements based on input configuration parameters like filesystem block size versus directory block size. It also relates to CWE-789, Memory Allocation Resources Exceeded, in the context of transactional space reservation within kernel memory structures managing disk blocks. In terms of MITRE ATT&CK mapping, while not a direct attack vector for adversaries, such logic errors can be leveraged in localized denial-of-service scenarios or as part of broader supply chain attacks targeting system reliability and availability during routine maintenance windows where scrubbing tools are actively deployed to ensure filesystem health.
To mitigate this vulnerability, the Linux kernel maintainers have implemented fixes that replace hardcoded assumptions about block counts with dynamic calculations using helper functions like xfs_dabuf_nfsb. This ensures that the number of file system blocks required for directory and extended attribute operations is accurately determined based on the specific geometry of the mounted filesystem. Administrators should ensure their systems are updated to kernel versions containing these patches, particularly those addressing commits related to XFS repair logic and block reservation calculations. Regular application of security updates and maintaining up-to-date kernel packages is essential to prevent potential stability issues arising from incorrect resource allocation in storage subsystems.