High 7.8Published Jul 23, 2026

CVE-2026-64600xfs: resample the data fork mapping after cycling ILOCK

Updated under an hour ago (Oct 26, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 before dc11be133efca5fe3a2fb02b016dee825cc12f18; from 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 before b8c9aa832b52680ee40d6cab0efb081f9a69df05; from 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 before 50f0012da1040f69a4e788cd9aed587c9a04983f; from 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 before e705d81a7193dd19e69b8e2bad4696d78a4ea075; from 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 before 206c09b04dc5469c7ff14d8aceff2d47c88078d9; from 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 before 44f891bc088958399eec27f7604928694aa35581; 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 builds before 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7	CNA record
linux linux_kernel linux:linux_kernel	from 4.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; 7.2; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18	patch
https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05	patch
https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f	patch
https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075	patch
https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9	patch
https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581	patch
https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7	patch
https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt	exploit, third-party-advisory
http://www.openwall.com/lists/oss-security/2026/07/22/14	exploit, mailing-list
http://www.openwall.com/lists/oss-security/2026/07/22/18	mailing-list
1–10 of 14

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.