CVE-2026-97552

A low impact flaw was found in the Linux kernel's XFS file system. An uninitialized error variable in xfs_defer_finish_one() can cause the function to return an indeterminate value when a deferred pending item contains no work items. On kernels built with CONFIG_XFS_ONLINE_REPAIR this state is reachable because xfs_reap_ag_blocks() adds an item-less barrier through xfs_defer_add_barrier(); since xfs_defer_finish_noroll() treats any non-EAGAIN return as fatal, a non-zero stack value is misinterpreted as in-core corruption and triggers an unexpected SHUTDOWN_CORRUPT_INCORE shutdown of the mounted XFS file system. A local user with sufficient privileges to initiate or interact with XFS online repair operations could use this flaw to cause a denial of service against the file system being repaired; the flaw is not network reachable and does not lead to information disclosure, data modification, or privilege escalation. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later (which ship RHEL CoreOS 9 based kernels) are affected where the introducing XFS reaping code is present, while Red Hat Enterprise Linux 6, 7, and 8, the Red Hat Enterprise Linux 9.2 and 9.4 update streams, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present in those versions. The fix is currently deferred for the affected streams because of the low impact and the privileged local access required to trigger the flaw; the residual risk is a locally triggered denial of service limited to the XFS file system undergoing online repair. Red Hat's low impact rating is lower than the moderate severity suggested by the CVSS 3.1 score of 5.5, reflecting the local privileged access requirement and the availability-only impact.