UBUNTU-CVE-2026-97551: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args->total for parent pointer updates xfsparentdaargsinit() builds an xfsdaargs from a zeroed xfsparentargs (kmemcachezalloc), leaving args->total == 0. xfsdagrowinodeint() treats that field as a running block reservation and subtracts from it; because it is an xfsextlent (uint32t), the first attr-fork growth wraps it to ~0U. That defeats the free-space check in xfsallocspaceavailable(), and when it coincides with an AG that has exactly zero available blocks the allocation is clamped to maxlen 0 and returns -ENOSPC, which xfsdeferfinishnoroll() escalates to a filesystem shutdown. Set args->total the way the log recovery path does (xfsattrirecoverwork(), xfsattritem.c:706), in the add and replace paths that can grow the fork. Removals and lookups never grow it, so they leave the field alone, matching that switch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Initialize args->total in the add and replace paths that can grow the fork, using the same approach as xfs_attri_recover_work().
Linux kernel XFS parent pointer updates args->total = initialized for add and replace paths
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using XFS are exposed when parent-pointer add or replace operations can grow the attribute fork. The listed affected Ubuntu kernel packages are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What conditions trigger the filesystem shutdown?
The issue requires an attribute-fork growth during a parent-pointer update and an allocation group with exactly zero available blocks. The wrapped block-reservation counter bypasses the free-space check, after which a zero-length allocation returns ENOSPC and deferred processing escalates it to an XFS filesystem shutdown.
Do parent-pointer removals or lookups trigger this issue?
No. The data states that removals and lookups do not grow the fork, so they leave the affected reservation field unchanged.