CVE-2026-98446 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't let hidden_space go negative in xfs_metafile_resv_init
LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space. We never want the target to be less than the used sapce, so fix the logic that adjusts dblocks_avail downwards.
Also fix an error in the adjacent comment.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's XFS filesystem implementation contains a critical integer underflow vulnerability within the metadata file reservation initialization routine, specifically affecting the xfs_metafile_resv_init function. This flaw arises from improper handling of free block counts when calculating reserved space for metadata btree files. The core issue is that if the available free blocks (fdblocks) drop below the amount already consumed by the metadata file itself, a subtraction operation intended to calculate hidden_space results in an unsigned integer underflow. Because these variables are typically treated as unsigned values within the filesystem's internal accounting structures, subtracting a larger value from a smaller one wraps around to a massive positive number rather than resulting in a negative value or triggering an error condition immediately.
This arithmetic error has severe downstream consequences for filesystem integrity and system stability. The corrupted hidden_space value is subsequently passed to xfs_dec_fdblocks, which interprets the underflowed result as a legitimate large quantity of blocks to decrement from the available free space pool. This effectively causes XFS to believe that significantly more disk space than actually exists has been allocated or reserved for metadata operations. Such a discrepancy disrupts the filesystem's internal bookkeeping mechanisms, potentially leading to incorrect allocation decisions where new files cannot be created despite apparent free space remaining on the volume. In extreme cases, this corruption can trigger kernel panics or cause the XFS journaling subsystem to enter an inconsistent state that requires manual intervention via fsck to repair before the system can boot reliably again.
From a vulnerability classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write if the corrupted accounting values lead to memory corruption during subsequent allocation attempts. The attack vector is primarily local, requiring an attacker to possess sufficient privileges to create files that exhaust free space while simultaneously triggering metadata btree growth operations. This scenario maps closely to MITRE ATT&CK technique T1485 Data Destruction, as the primary impact involves corrupting filesystem structures and potentially rendering data inaccessible due to allocation failures or journal inconsistencies. The vulnerability is not remotely exploitable but represents a significant risk in environments where disk space management is critical and automated processes might inadvertently trigger edge cases during high-load conditions or near-full volume scenarios.
Mitigation strategies for this vulnerability involve applying the upstream kernel patch that corrects the logic within xfs_metafile_resv_init to ensure hidden_space never underflows by enforcing a lower bound check against used space before performing subtraction operations. System administrators should prioritize updating their Linux kernels to versions where this fix is included, particularly those running XFS filesystems on volumes prone to high metadata churn or near-capacity usage patterns. Additionally, monitoring tools that track free block counts and allocation failures can help detect early signs of accounting discrepancies caused by similar bugs in other subsystems. Regular maintenance using xfs_repair after unexpected shutdowns or crashes is also recommended to ensure filesystem consistency remains intact despite potential edge-case errors during operation.