CVE-2026-97547
Description
A flaw was found in the Linux kernel's XFS file system. When exchanging file ranges between files that share storage blocks (reflinks), a local user can trigger a condition where the system prematurely clears copy-on-write protection flags from a file that still retains shared data blocks. Consequently, subsequent write operations bypass Copy-on-Write (CoW) mechanisms and directly overwrite shared blocks, resulting in data corruption across related files.
Statement
This vulnerability is rated as Moderate because exploitation requires an authenticated local user with write access to files on an XFS filesystem and depends on specific range-swapping operations to induce data corruption. Although XFS is the default file system across Red Hat Enterprise Linux installations, triggering this behavior requires calling specialized range exchange interfaces on files with shared extents rather than standard file I/O workloads. Systems operating on earlier enterprise releases lack the underlying exchange functionality entirely and remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
