Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64600— xfs: resample the data fork mapping after cycling ILOCK

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 4.11版本存在安全漏洞，该漏洞源于xfs文件系统中数据fork映射在ILOCK周期后未重新采样，可能导致直接I/O写入时使用过时的映射。

CVSS 7.8 · High EPSS 0.47% · P39

Possible ATT&CK Techniques 1 AI

T1564.004 · NTFS File Attributes

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< dc11be133efca5fe3a2fb02b016dee825cc12f18 affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< b8c9aa832b52680ee40d6cab0efb081f9a69df05 affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< 50f0012da1040f69a4e788cd9aed587c9a04983f affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< e705d81a7193dd19e69b8e2bad4696d78a4ea075 affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< 206c09b04dc5469c7ff14d8aceff2d47c88078d9 affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< 44f891bc088958399eec27f7604928694aa35581 affected
3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5< 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 affected
4.11 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64600

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xfs: resample the data fork mapping after cycling ILOCK
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 4.11版本存在安全漏洞，该漏洞源于xfs文件系统中数据fork映射在ILOCK周期后未重新采样，可能导致直接I/O写入时使用过时的映射。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 ~ dc11be133efca5fe3a2fb02b016dee825cc12f18 -
Linux Linux 4.11 -

II. Public POCs for CVE-2026-64600

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64600

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64600 (6)

Vendor Advisories for CVE-2026-64600 (1)

Other References for CVE-2026-64600 (1)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64600

No comments yet

Leave a comment