CVE-2026-98446
Linux: xfs: don't let hidden_space go negative in xfs_metafile_resv_init
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in930a9c1c321efdaa3e7f8caecb0479cee3baf342Also 476582d754cdc5110f806001417fea6c77824c13CVE List
What fixes it
- 930a9c1c321efdaa3e7f8caecb0479cee3baf342LinuxCVE List
- 476582d754cdc5110f806001417fea6c77824c13LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't let hidden_space go negative in xfs_metafile_resv_init
LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space. We never want the target to be less than the used sapce, so fix the logic that adjusts dblocks_avail downwards.
Also fix an error in the adjacent comment.
Text from CVE List
Affected versions 8
- Linuxaffected: 1df8d75030b787a9fae270b59b93eef809dd2011 before 930a9c1c321efdaa3e7f8caecb0479cee3baf342CVE List
- Linuxaffected: 1df8d75030b787a9fae270b59b93eef809dd2011 before f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dcCVE List
- Linuxaffected: 1df8d75030b787a9fae270b59b93eef809dd2011 before 476582d754cdc5110f806001417fea6c77824c13CVE List
- Linuxaffected: 6.15CVE List
- Linuxunaffected: all versions before 6.15CVE List
- Linuxunaffected: 6.18.55 through 6.18.*CVE List
- Linuxunaffected: 7.2.9 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List