CVE-2026-97548

A moderate-impact flaw was found in the Linux kernel's XFS file system. The _maxlevels_ondisk functions for the realtime reverse-mapping (rtrmap) and realtime reference-count (rtrefcount) btree types fail to account for the inode root when computing the size of in-memory btree cursors, so the kernel can allocate a cursor buffer that is too small. When processing a sufficiently large realtime btree, this leads to an out-of-bounds memory access beyond the end of the cursor buffer. A local user with write access to a mounted XFS filesystem that uses realtime reverse-mapping or reference-count btrees could use this flaw to cause a kernel panic, resulting in a denial of service or system crash. Red Hat rates this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream Important rating (CVSS 7.8), because exploitation requires an uncommon XFS realtime configuration and lengthy preparation to grow the btree to the required depth, and Red Hat's analysis finds no confidentiality or integrity impact, only impact to availability. In Red Hat Enterprise Linux 10 and RHIVOS 2 the vulnerable code is present and the affected streams are confirmed as affected, with the fix currently deferred; until a fix is delivered, the residual risk is limited to local users able to write to XFS realtime filesystems that exercise these btree features. Red Hat Enterprise Linux 6, 7, 8, and 9, as well as the OpenShift 4 and 5 streams, are not affected because the vulnerable code is not present in the kernels shipped for those products.