CVE-2026-97548

A flaw was found in the Linux kernel's XFS file system. A local user can cause a Denial of Service (DoS) or system crash through an out-of-bounds memory access when processing large real-time reverse-mapping or reference count data structures. The issue occurs because the size calculation for in-memory cursor buffers fails to account for the root node level, causing the kernel to allocate insufficient memory and access beyond the end of the buffer.

A moderate-impact flaw was found in the Linux kernel's XFS file system. The _maxlevels_ondisk functions for the realtime reverse-mapping (rtrmap) and realtime reference-count (rtrefcount) btree types fail to account for the inode root when computing the size of in-memory btree cursors, so the kernel can allocate a cursor buffer that is too small. When processing a sufficiently large realtime btree, this leads to an out-of-bounds memory access beyond the end of the cursor buffer. A local user with write access to a mounted XFS filesystem that uses realtime reverse-mapping or reference-count btrees could use this flaw to cause a kernel panic, resulting in a denial of service or system crash. Red Hat rates this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream Important rating (CVSS 7.8), because exploitation requires an uncommon XFS realtime configuration and lengthy preparation to grow the btree to the required depth, and Red Hat's analysis finds no confidentiality or integrity impact, only impact to availability. In Red Hat Enterprise Linux 10 and RHIVOS 2 the vulnerable code is present and the affected streams are confirmed as affected, with the fix currently deferred; until a fix is delivered, the residual risk is limited to local users able to write to XFS realtime filesystems that exercise these btree features. Red Hat Enterprise Linux 6, 7, 8, and 9, as well as the OpenShift 4 and 5 streams, are not affected because the vulnerable code is not present in the kernels shipped for those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.