Look up another CVE · open CVE-2026-64600 in the interactive tracker

CVE-2026-64600

xfs: resample the data fork mapping after cycling ILOCK

7.8 EPSS 0.5% AV:L

Published 2026-07-23 (3 months ago) by the Linux kernel CNA. Subsystem fs/xfs. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-64600 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4720-1 · 2026-08-05 · text	6.1.180-1	Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.96-1	Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.
Debian 12bookworm · linux-6.12	fixedDLA-4724-1 · 2026-08-07 · text	6.12.100-1~deb12u1	Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/xfs/xfs_reflink.c

What this is: XFS FILESYSTEMMAINTAINERS section matched on fs/xfs/ · linux-xfs@vger.kernel.org · Supported
Kernel module: xfs

Check it on the machine

grep -w CONFIG_XFS_FS /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w xfs

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sid, bookworm · linux-6.12m

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_XFS_FS

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-23 (3 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.47%, higher than 39.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: fs/xfs

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.11	5.15.212	dc11be133efc
4.11	6.1.178	b8c9aa832b52
4.11	6.6.145	50f0012da104
4.11	6.12.96	e705d81a7193
4.11	6.18.39	206c09b04dc5
4.11	7.1.4	44f891bc0889
4.11	7.2	2f4acd0fcd86

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4724-1	2026-08-07	bookworm 6.12.100-1~deb12u1	tracker
DLA-4723-1	2026-08-07	bullseye 6.1.180-1~deb11u1	tracker
DLA-4720-1	2026-08-05	bookworm 6.1.180-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.
AC:LAttack complexity, low: The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.
PR:LPrivileges required, low: A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.
UI:NUser interaction, none: The attacker creates the reflink and triggers both sides of the race without any victim action.
S:UScope, unchanged: This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.
C:HConfidentiality impact, high: Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.
I:HIntegrity impact, high: The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.
A:HAvailability impact, high: The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability.