CVE-2026-97549
Description
A flaw was found in the Linux kernel's XFS file system. An incorrect block calculation during the online repair of shortform directories and extended attributes causes transaction space to be under-reserved. A local user capable of triggering metadata repair operations can exploit this flaw to cause an assertion failure or filesystem shutdown, leading to a Denial of Service (DoS).
Statement
A low severity denial of service flaw was found in the XFS file system code of the Linux kernel as shipped in Red Hat products. When the XFS online repair code converts a shortform directory or extended attribute structure to block form on a filesystem whose directory block spans multiple filesystem blocks, it incorrectly assumes that only a single filesystem block is required and under-reserves transaction space. A local user able to invoke XFS online metadata repair operations (for example through xfs_scrub) on such a filesystem can trigger an assertion failure or a filesystem shutdown, resulting in a denial of service. The flaw does not lead to information disclosure, data corruption, or privilege escalation.
The Red Hat Enterprise Linux 9 kernel (streams 9.8 and later) and Red Hat Enterprise Linux 10 kernel, Red Hat In-Vehicle OS 2, and the RHEL 9 CoreOS-based OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 streams are affected. Fixes for these streams are deferred because the flaw is rated low impact and triggering it requires privileged local access together with an XFS filesystem whose directory block size differs from its filesystem block size; the residual risk is limited to a locally induced assertion failure or filesystem shutdown. Earlier Red Hat Enterprise Linux 6, 7, and 8 releases and earlier Red Hat Enterprise Linux 9 streams are not affected because the vulnerable code is not present.
Although the Red Hat CVSS 3.1 base score for this flaw is 5.5 (moderate), Red Hat rates the overall impact as low because exploitation requires local access and the ability to invoke privileged XFS online repair operations on a filesystem with a specific geometry, and the consequence is confined to availability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
