CVE-2026-97546

A low impact denial of service flaw was found in the Linux kernel's XFS file system online directory repair code. When salvaging directory entries during a repair operation, the recovery loop in xrep_dir_recover_data (fs/xfs/scrub/dir_repair.c) fails to advance if it encounters an unused directory entry that claims zero length, causing an infinite loop that consumes CPU and hangs the repair task. A local user could trigger this flaw by mounting or repairing a crafted, corrupted XFS file system containing zero-length directory entries; reaching the vulnerable path requires local privileges such as the ability to mount file systems or invoke XFS online repair. Only availability is affected, with no impact on confidentiality or integrity. Although the Red Hat CVSS 3.1 base score is 5.5 (moderate), Red Hat rates the impact of this flaw as low because exploitation requires local privileged access and a deliberately corrupted file system, and the consequence is limited to a hung repair task.

The vulnerable XFS online directory repair code is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10), Red Hat Enterprise Linux 10 (rhel-10.0.z, rhel-10.2.z, rhel-10.3, rhel-10.4), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and the rhel-coreos-9 based OpenShift Container Platform releases 4.22, 4.23, 5.0, and 5.1, which are marked affected. Red Hat Enterprise Linux 6, 7, and 8, earlier Red Hat Enterprise Linux 9 update streams, the kernel-rt streams, and OpenShift Container Platform releases before 4.22 do not contain the vulnerable code and are therefore not affected. For the affected products the fix is deferred because this is a low severity, local denial of service gated behind privileged operations; the residual risk is that a local privileged user processing a corrupted XFS file system can keep a kernel thread spinning and consuming CPU until the repair operation is terminated.