CVE-2026-64600

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-64600

Key Details

CVE	CVE-2026-64600
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

xfs: resample the data fork mapping after cycling ILOCK

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,

a data fork mapping, and a cow fork mapping. Unfortunately, these two

helpers cycle the ILOCK to grab a transaction, which means that the

mappings are stale as soon as we reacquire the ILOCK. Currently we

refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but

we don't refresh the data fork mapping beforehand, which means that the

xfs_bmap_trim_cow in that function queries the refcount btree about the

wrong physical blocks and returns an inaccurate value in *shared.

If *shared is now false, the directio write proceeds with a stale data

fork mapping. Fix this by querying the data fork mapping if the

sequence counter changes across the ILOCK cycle. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-64600
CVE	https://www.cve.org/CVERecord?id=CVE-2026-64600

Source

Reference

NVD

CVE