AZL-110593: CVE-2026-98872 affecting package kernel 6.6.157.1-1

Q: What conditions are needed to trigger the crash?

A regular file backed by FreeVxFS must contain an on-disk typed extent whose type is not one of the four types handled by vxfs_bmap_typed(). The condition is reachable through ioctl(FIBMAP) on that regular file.

Q: Which systems are realistically exposed?

Systems that process affected FreeVxFS regular files are exposed to the crash condition. The provided data does not state whether FreeVxFS support is enabled or mounted by default.

Q: How can I recognize that this issue has been triggered?

A vulnerable kernel can report a kernel BUG at fs/freevxfs/vxfs_bmap.c:230, with vxfs_bmap_typed in the call trace. The described failure occurs while handling FIBMAP through vxfs_bmap1.

Q: What happens after the fix when an unknown typed-extent type is encountered?

The kernel emits WARN_ON_ONCE() instead of BUG() and returns 0 from vxfs_bmap_typed(). vxfs_getblk() converts that result to -EIO, so the ioctl fails cleanly rather than crashing the kernel.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

freevxfs: don't BUG() on unknown typed-extent type

vxfsbmaptyped() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file:

kernel BUG at fs/freevxfs/vxfsbmap.c:230! RIP: vxfsbmaptyped fs/freevxfs/vxfsbmap.c:230 [inline] vxfsbmap1+0x128a/0x12d0 fs/freevxfs/vxfsbmap.c:257

Replace the BUG() with WARNONONCE() and return 0 -- the value vxfsbmaptyped() already returns on failure (and from the DEV4 case above); vxfsgetblk() maps 0 to -EIO, so the ioctl fails cleanly.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 23, 2026

Advisory Published

via OSV·12:18 PM

Data Sourced

via OSV·12:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-98872

Frequently Asked Questions

What conditions are needed to trigger the crash?

A regular file backed by FreeVxFS must contain an on-disk typed extent whose type is not one of the four types handled by vxfs_bmap_typed(). The condition is reachable through ioctl(FIBMAP) on that regular file.

Which systems are realistically exposed?

Systems that process affected FreeVxFS regular files are exposed to the crash condition. The provided data does not state whether FreeVxFS support is enabled or mounted by default.

How can I recognize that this issue has been triggered?

A vulnerable kernel can report a kernel BUG at fs/freevxfs/vxfs_bmap.c:230, with vxfs_bmap_typed in the call trace. The described failure occurs while handling FIBMAP through vxfs_bmap1.

What happens after the fix when an unknown typed-extent type is encountered?

The kernel emits WARN_ON_ONCE() instead of BUG() and returns 0 from vxfs_bmap_typed(). vxfs_getblk() converts that result to -EIO, so the ioctl fails cleanly rather than crashing the kernel.

AZL-110593: CVE-2026-98872 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are needed to trigger the crash?

Which systems are realistically exposed?

How can I recognize that this issue has been triggered?

What happens after the fix when an unknown typed-extent type is encountered?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the crash?

Which systems are realistically exposed?

How can I recognize that this issue has been triggered?

What happens after the fix when an unknown typed-extent type is encountered?