CVE-2026-64357

xfs: fix exchmaps reservation limit check

MEDIUM
5.5
CVSS Score
Published: July 25, 2026 at 08:50 AM UTC
Updated: September 4, 2026 at 04:16 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added. The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.10 ≤ v < 6.12.966.10 ≤ v < 6.18.396.10 ≤ v < 7.1.46.10 ≤ v < 7.26.13 ≤ v < 6.18.396.19 ≤ v < 7.1.46.10966ceafc7a437105ecfe1cadb3747b2965a260ca
Vendor states this is fixed in 0a5213bbff62b51c7d4999ac8c7e11ea57d00d45 (fixed)
Vendor states this is fixed in 4707344b0d36d1012c8a1716e20167cd3afdd5f1 (fixed)
Vendor states this is fixed in a62ef2d13d6e7270dd5e88c6082bf2d0edcd5112 (fixed)
Vendor states this is fixed in c597c8580d50127fc1221b5a5b653a94d49e23e3 (fixed)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.12.96 (unaffected)
Vendor states this is fixed in 6.18.39 (unaffected)
Vendor states this is fixed in 7.1.4 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card