CVE-2026-98446: xfs: don't let hidden_space go negative in xfs_metafile_resv_init
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't let hiddenspace go negative in xfsmetafileresvinit
LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace subtraction can underflow, causing xfsdecfdblocks to subtract a huge amount of space. We never want the target to be less than the used sapce, so fix the logic that adjusts dblocksavail downwards.
Also fix an error in the adjacent comment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition triggers the faulty accounting?
The issue occurs when the filesystem's available fdblocks reservation for a metadata btree file falls below the space that the file already uses. The resulting hidden_space subtraction can underflow and cause xfs_dec_fdblocks to subtract an excessively large amount of space.
Which systems are relevant to triage?
This affects the XFS filesystem code in the Linux kernel. Systems not using XFS are not implicated by the information provided.
What is the immediate remediation?
Apply a Linux kernel update containing the upstream stable fixes referenced for this issue. The fix prevents the reservation target from being reduced below the metadata btree file's already-used space.