All vulnerabilities
CVE-2026-97546

Linux: xfs: don't spin forever on zero-length dirents when salvaging them

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5442f0c56445618544a801fb4dae35aed87a1aaaAlso 08754ebfa5c28e8d57316b1bd7a5a921a5e2e762, 9f84792b40d0c96833341602144574bf0bd14a6aCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5442f0c56445618544a801fb4dae35aed87a1aaaLinuxCVE List
  • 08754ebfa5c28e8d57316b1bd7a5a921a5e2e762LinuxCVE List
  • 9f84792b40d0c96833341602144574bf0bd14a6aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't spin forever on zero-length dirents when salvaging them

LOLLM noticed that xrep_dir_recover_data can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing from happening with a zero-length entry.

Text from CVE List

Affected versions 10

  • Linuxaffected: b1991ee3e7cf852e95a3498801303cfbb4468681 before 5442f0c56445618544a801fb4dae35aed87a1aaaCVE List
  • Linuxaffected: b1991ee3e7cf852e95a3498801303cfbb4468681 before 08754ebfa5c28e8d57316b1bd7a5a921a5e2e762CVE List
  • Linuxaffected: b1991ee3e7cf852e95a3498801303cfbb4468681 before a455c83ce5dc1a2da33b1b84253d298372a8dfbdCVE List
  • Linuxaffected: b1991ee3e7cf852e95a3498801303cfbb4468681 before 9f84792b40d0c96833341602144574bf0bd14a6aCVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4