CVE-2026-98974

A flaw was found in the Linux kernel's XFS file system. This vulnerability allows a local user to cause unauthorized data modification or potential privilege escalation by bypassing Copy-on-Write (CoW) protections. When exchanging file data ranges up to the end of a file, the file system incorrectly calculates file sizes and leaves shared blocks in an inconsistent state. Consequently, a local attacker can directly overwrite shared data blocks belonging to other files without triggering required copy-on-write protections.

This vulnerability is rated as Important because an unprivileged local attacker can corrupt or alter shared extents across separate files on an XFS volume. By manipulating boundary sizes during range exchanges on files they can read, an attacker can circumvent copy-on-write safeguards to overwrite arbitrary system binaries or documents. This can result in unauthorized modification of host resources and potential elevation of privileges on deployments utilizing modern XFS capabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to restrict unprivileged access to XFS_IOC_EXCHANGE_RANGE and FICLONERANGE ioctls or mount XFS filesystems without exchange-range and reflink on multi-user boundaries: upgrade to the fixed Erlang/Kernel/Kernel Rt/Kpatch builds, which calculate new file sizes using exchange offsets and exchanged data lengths for TO_EOF operations and flush the page cache prior to range exchange, closing all 3 injection vectors (FICLONERANGE ioctl block sharing, XFS_IOC_EXCHANGE_RANGE ioctl with TO_EOF flag, direct pwrite overwrite bypassing copy-on-write). Until patched, this is only a concern on Linux deployments with XFS filesystems mounted with reflink and exchange-range features where unprivileged local users have file read and write access — Non-Linux platforms and filesystems without reflink and exchange-range enabled are unaffected — so restrict unprivileged user access to XFS volumes supporting reflink and exchange-range, monitor donor file creation in shared directories, and restrict read permissions on critical files to prevent block cloning. As a compensating measure, log XFS ioctl syscall invocations and suspicious file write events across the local filesystem using auditd, enforce SELinux in enforcing mode to provide MAC containment that limits domain transitions if shared files are altered, map local login users into restricted SELinux confined domains to limit execution privileges and post-exploitation capabilities, monitor with an EDR agent to detect suspicious local privilege escalation behaviors and unexpected writes to system files, use Falco or eBPF runtime security probes to detect anomalous FICLONERANGE and XFS_IOC_EXCHANGE_RANGE ioctl operations and file modifications in real time, and use AIDE or file integrity monitoring to detect unauthorized modifications to critical system binaries and configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying file size exchange calculation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)