CVE-2026-97551: xfs: initialise args->total for parent pointer updates
In the Linux kernel, the following vulnerability has been resolved:
xfs: initialise args->total for parent pointer updates
xfsparentdaargsinit() builds an xfsdaargs from a zeroed xfsparentargs (kmemcachezalloc), leaving args->total == 0. xfsdagrowinodeint() treats that field as a running block reservation and subtracts from it; because it is an xfsextlent (uint32t), the first attr-fork growth wraps it to ~0U. That defeats the free-space check in xfsallocspaceavailable(), and when it coincides with an AG that has exactly zero available blocks the allocation is clamped to maxlen 0 and returns -ENOSPC, which xfsdeferfinishnoroll() escalates to a filesystem shutdown.
Set args->total the way the log recovery path does (xfsattrirecoverwork(), xfsattritem.c:706), in the add and replace paths that can grow the fork. Removals and lookups never grow it, so they leave the field alone, matching that switch.
Affected Software
Event History
Frequently Asked Questions
What filesystem operations are affected?
The issue affects XFS parent pointer add and replace operations that can grow the attribute fork. Parent pointer removals and lookups do not grow the fork and are not affected by this initialization problem.
What conditions lead to a filesystem shutdown?
The failure requires the first attribute-fork growth to encounter an allocation group with exactly zero available blocks. The wrapped reservation value defeats the free-space check, after which a zero-length allocation returns ENOSPC and deferred processing escalates that error to a filesystem shutdown.
How might an affected system present operationally?
An affected XFS filesystem can shut down during a parent pointer update when the attribute fork needs to grow and the relevant allocation group has no free blocks. The immediate error path described is an ENOSPC result from the allocation followed by filesystem shutdown.