CVE-2026-97548

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896 416baaa9-dc9f-4396-8d5f-8c081fb06d67

The full cvelistV5 record. Download as CVE-2026-97548.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "108114437915e61e8f88d1cbcc442c3f886a347e",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "84316cb25af95a60e655ccc8fe646bb5ad631b71",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            },
            {
              "lessThan": "aa301322f72f82f26e4ba0826018d41388ab9896",
              "status": "affected",
              "version": "9abe03a0e4f978615a2b1b484b8d09ca84c16ea0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/libxfs/xfs_rtrefcount_btree.c",
            "fs/xfs/libxfs/xfs_rtrmap_btree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions\n\nThe _maxlevels_ondisk functions are used to compute the size of\nin-memory btree cursors for each btree type.  Unfortunately, LOLLM\nnoticed that the rtrmap and rtrefcount versions of these functions\nforget to account for the inode root, which means that we could access\nbeyond the end of the cursor given a sufficiently large btree.  Fix\nthis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven by on-disk XFS fields: sb_blocksize/sb_rgextents consumed by xfs_rtrefcountbt_compute_maxlevels() and the /rtgroups/N.refcount inode-root bb_level loaded by xfs_iformat_rtrefcount(). Entry is mount(2)\u2192xfs_init_fs_context()\u2192get_tree_bdev()\u2192xfs_fs_fill_super()\u2192xfs_mountfs()\u2192xfs_log_mount_finish()\u2192xlog_recover_finish()\u2192xfs_reflink_recover_cow(); no NFS/SMB/TCP message carries bb_level.\nAC:L - xfs_rtrefcountbt_maxlevels_ondisk() sizes the xfs_rtrefcountbt_cur slab for 6 bc_levels slots. A 1K-block rtreflink image with large sb_rgextents makes xfs_rtrefcountbt_compute_maxlevels() set m_rtrefc_maxlevels=7; xfs_iformat_rtrefcount() accepts bb_level=6, so xfs_rtrefcountbt_init_cursor() sets bc_nlevels=7 and xfs_btree_lookup() stores bc_levels[6].ptr. A dirty log makes xlog_recovery_needed() true so this runs on every mount; no race.\nPR:N - Crafting the image needs no host account. xfs_fs_type.fs_flags is FS_REQUIRES_DEV|FS_ALLOW_IDMAP|FS_MGTIME|FS_LBS with no FS_USERNS_MOUNT, so mount_capable() is capable(CAP_SYS_ADMIN) in init_user_ns; that privileged mount of the attacker image is scored as UI:R, not attacker privilege.\nUI:R - xfs_rtrefcountbt_init_cursor() runs from xfs_refcount_recover_cow_leftovers() in xfs_reflink_recover_cow() during xlog_recover_finish() after xfs_fs_fill_super() attaches the attacker bdev. Because XFS is not FS_USERNS_MOUNT, a victim, automounter, or administrator must mount that image before the undersized cursor is built.\nS:U - The bc_levels[] store in xfs_btree_lookup() corrupts the xfs_rtrefcountbt_cur slab in the host kernel that mounted the volume; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.\nC:H - xfs_btree_lookup() writes cur->bc_levels[level].ptr (uint16_t) at level=bc_nlevels-1 when the xfs_rtrefcountbt_cur object from xfs_rtrefcountbt_maxlevels_ondisk() has only 6 slots; that slab OOB write can disclose or influence adjacent heap objects.\nI:H - The same out-of-bounds store of bc_levels[6].ptr past the 6-slot xfs_rtrefcountbt_cur kmem_cache object is a kernel heap write into whatever follows the cursor, enabling adjacent-object corruption toward an arbitrary write or control-flow hijack.\nA:H - xfs_btree_simple_query_range() calls xfs_btree_lookup() on that undersized cursor from xfs_refcount_recover_cow_leftovers() during mount recovery; indexing bc_levels[6] oopses or panics the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:11.843Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/108114437915e61e8f88d1cbcc442c3f886a347e"
        },
        {
          "url": "https://git.kernel.org/stable/c/84316cb25af95a60e655ccc8fe646bb5ad631b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa301322f72f82f26e4ba0826018d41388ab9896"
        }
      ],
      "title": "xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97548",
    "datePublished": "2026-09-25T10:21:42.239Z",
    "dateReserved": "2026-09-24T16:01:01.154Z",
    "dateUpdated": "2026-09-25T14:41:11.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}