CVE-2026-98974

--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to restrict unprivileged access to XFS_IOC_EXCHANGE_RANGE and FICLONERANGE ioctls or mount XFS filesystems without exchange-range and reflink on multi-user boundaries: upgrade to the fixed Erlang/Kernel/Kernel Rt/Kpatch builds, which calculate new file sizes using exchange offsets and exchanged data lengths for TO_EOF operations and flush the page cache prior to range exchange, closing all 3 injection vectors (FICLONERANGE ioctl block sharing, XFS_IOC_EXCHANGE_RANGE ioctl with TO_EOF flag, direct pwrite overwrite bypassing copy-on-write). Until patched, this is only a concern on Linux deployments with XFS filesystems mounted with reflink and exchange-range features where unprivileged local users have file read and write access — Non-Linux platforms and filesystems without reflink and exchange-range enabled are unaffected — so restrict unprivileged user access to XFS volumes supporting reflink and exchange-range, monitor donor file creation in shared directories, and restrict read permissions on critical files to prevent block cloning. As a compensating measure, log XFS ioctl syscall invocations and suspicious file write events across the local filesystem using auditd, enforce SELinux in enforcing mode to provide MAC containment that limits domain transitions if shared files are altered, map local login users into restricted SELinux confined domains to limit execution privileges and post-exploitation capabilities, monitor with an EDR agent to detect suspicious local privilege escalation behaviors and unexpected writes to system files, use Falco or eBPF runtime security probes to detect anomalous FICLONERANGE and XFS_IOC_EXCHANGE_RANGE ioctl operations and file modifications in real time, and use AIDE or file integrity monitoring to detect unauthorized modifications to critical system binaries and configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying file size exchange calculation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)