All vulnerabilities
CVE-2026-98872

Linux: freevxfs: don't BUG() on unknown typed-extent type

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in500e9d5bf9eff2096a21b7ac25a0a06ca46ab821Also 7ada9807e37103b41f586d34e3075e1209182b65, 1284d687d46953fff9c0d969df108114611aca8b and 8 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 500e9d5bf9eff2096a21b7ac25a0a06ca46ab821LinuxCVE List
  • 7ada9807e37103b41f586d34e3075e1209182b65LinuxCVE List
  • 1284d687d46953fff9c0d969df108114611aca8bLinuxCVE List
  • 405f13d7b270913e06e8e2b4de568985f94ef7d6LinuxCVE List
  • 704d48d81dc41470e108811c32c577ada66192d4LinuxCVE List
  • 5.10.271LinuxCVE List
Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

freevxfs: don't BUG() on unknown typed-extent type

vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file:

kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257

Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.

Text from CVE List

Affected versions 20

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fe40a19d571cbb584eea46038ee919d8712b2d2cCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 500e9d5bf9eff2096a21b7ac25a0a06ca46ab821CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f1f2d54a576f0e4133b979e545abcfefd439c300CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7ada9807e37103b41f586d34e3075e1209182b65CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1284d687d46953fff9c0d969df108114611aca8bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 405f13d7b270913e06e8e2b4de568985f94ef7d6CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 704d48d81dc41470e108811c32c577ada66192d4CVE List
  • Linuxaffected: all versions before 5.10.271CVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7