CVE-2026-98447 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory corruption of whatever's beyond the buffers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel’s XFS filesystem implementation contains a critical buffer overflow vulnerability within its real-time reference count btree root formatting logic. This flaw was identified by researchers at LOLLM and stems from an incorrect assumption regarding the structure of on-disk metadata nodes. Specifically, when initializing or formatting the roots of the realtime refcount b-tree, the kernel code performs a memory copy operation that transfers more data than is actually present in the source node blocks. The technical root cause lies in the fact that XFS node blocks for this specific btree type contain only one set of keys and associated metadata structures per block during initialization, yet the formatting routine erroneously attempts to duplicate two sets worth of data into a destination buffer allocated with insufficient size or without proper bounds checking relative to the actual content.
This memory corruption issue represents a classic out-of-bounds write scenario that can lead to severe system instability. By writing beyond the intended boundaries of the target buffer, the vulnerability corrupts adjacent memory regions in kernel space. Depending on what data resides immediately following the allocated structure for the btree root, this could overwrite critical control structures, pointers, or other filesystem metadata. Such corruption undermines the integrity of the XFS filesystem and can result in unpredictable behavior ranging from silent data degradation to immediate kernel panics. In worst-case scenarios where an attacker has local access and can trigger specific allocation patterns that place sensitive kernel objects adjacent to these buffers, this flaw could potentially be leveraged for privilege escalation or arbitrary code execution within the kernel context.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing data past the end of a buffer due to an incorrect calculation of copy length. It also relates to CWE-134: Use of Externally-Controlled Format String if one considers how malformed metadata could be crafted during specific mount or filesystem operations that trigger this formatting path. In terms of adversarial tactics, while primarily exploitable through local file system interactions, it falls under the broader category of exploitation for privilege escalation and defense evasion by corrupting kernel memory structures to bypass integrity checks. The ATT&CK framework would categorize potential exploitation vectors related to kernel memory corruption under techniques involving direct manipulation of operating system processes or components, specifically those that allow for gaining higher-level permissions through software vulnerabilities.
The operational impact is significant because XFS is widely used in enterprise environments handling large-scale data storage. A successful exploit could compromise the confidentiality, integrity, and availability of stored data by corrupting filesystem structures required for proper mounting and operation. Furthermore, kernel crashes caused by such memory corruption lead to service outages, impacting business continuity. Mitigation strategies primarily involve applying vendor-provided patches that correct the memcpy length parameter in the xfs_rtrefcount btree formatting functions. System administrators should ensure their kernels are updated with fixes addressing this specific issue. Additionally, enabling Kernel Address Sanitizer (KASAN) during development and testing phases can help detect such out-of-bounds accesses early in the software lifecycle. For production systems, restricting untrusted user access to filesystem manipulation operations where possible reduces the attack surface for triggering these vulnerable code paths until patches are deployed.