CVE-2026-64357: Linux Kernel Privilege Escalation Flaw

CVE-2026-64357 Overview

CVE-2026-64357 is a Linux kernel vulnerability in the XFS filesystem's xfs_exchmaps_estimate_overhead() function. The flaw involves an incorrect reservation limit check in the exchmaps (exchange mappings) code path. The function adds btree mapping (bmbt) and reverse mapping btree (rmapbt) overhead to a local resblks variable, but the final UINT_MAX bounds check still tests the original req->resblks value from before overhead was added. The computed reservation is then passed to xfs_trans_alloc(), which accepts an unsigned int block reservation argument. A patch has been merged into the mainline kernel to validate the computed value against the existing limit.

Critical Impact
A missing bounds check on the computed reservation value can allow a value exceeding UINT_MAX to reach xfs_trans_alloc(), potentially causing integer truncation and filesystem transaction inconsistency on XFS volumes.

Affected Products

Linux kernel versions containing the XFS exchmaps (exchange mappings) implementation
Distributions shipping affected upstream Linux kernel builds with XFS enabled
Systems using XFS as the primary filesystem for workloads leveraging file range swap operations

Discovery Timeline

2026-07-25 - CVE-2026-64357 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64357

Vulnerability Analysis

The vulnerability resides in xfs_exchmaps_estimate_overhead(), part of the XFS filesystem code that estimates block reservations for exchange-mappings operations. The function calculates additional overhead required for the block mapping btree (bmbt) and reverse mapping btree (rmapbt) and stores the sum in a local resblks variable. It then validates the reservation against UINT_MAX to guarantee the value fits within the unsigned integer accepted by xfs_trans_alloc().

The check operates on the wrong variable. Instead of validating the newly computed reservation, the code compares req->resblks, which still holds the pre-overhead value. The computed value is then written back to req->resblks and passed downstream. This gap means an overhead-inclusive value that overflows a 32-bit unsigned range can silently propagate into transaction allocation without triggering the intended limit rejection.

Root Cause

The root cause is an Integer Overflow condition combined with an Input Validation error. The bounds check evaluates a stale variable rather than the newly summed value, defeating the guard against oversized reservations passed to xfs_trans_alloc().

Attack Vector

Exploitation requires local access and the ability to trigger XFS exchange-mappings operations with sufficiently large mapping counts. No proof-of-concept code has been published, and no in-the-wild exploitation has been reported. The vulnerability is primarily a filesystem robustness issue rather than a network-reachable attack surface.

The fix, applied in commits 0a5213b, 4707344, a62ef2d, and c597c85, changes the check to evaluate the computed reservation so the existing UINT_MAX limit applies to the value actually used by the transaction subsystem. See the Kernel Git Commit 0a5213b for the patch.

Detection Methods for CVE-2026-64357

Indicators of Compromise

Unexpected XFS transaction failures or filesystem shutdown events referencing xfs_trans_alloc() in kernel logs
Kernel warnings or panics originating from XFS exchmaps code paths on affected kernel versions
Anomalous processes issuing high-volume FIEXCHANGE_RANGE or exchange-mappings ioctls against XFS mounts

Detection Strategies

Inventory kernel versions across the fleet and correlate against the fixed commits (0a5213b, 4707344, a62ef2d, c597c85) to identify unpatched hosts
Monitor dmesg and journalctl -k for XFS assertion failures, XFS_CORRUPTION_ERROR, or transaction abort messages
Review audit logs for user-space callers invoking exchange-mappings ioctls, which are uncommon in typical workloads

Monitoring Recommendations

Enable kernel crash reporting (kdump) to capture forensic detail if XFS transaction paths trigger a panic
Aggregate kernel logs centrally and alert on repeated XFS errors originating from the same process or mount point
Track filesystem health metrics on XFS volumes and investigate sudden mount-time recovery events

How to Mitigate CVE-2026-64357

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 0a5213b, 4707344, a62ef2d, and c597c85 from kernel.org
Update to a distribution kernel release that incorporates the fix once available from your vendor
Reboot systems after installing the patched kernel to ensure the corrected XFS code path is loaded

Patch Information

The fix modifies xfs_exchmaps_estimate_overhead() so the UINT_MAX bounds check evaluates the computed reservation rather than req->resblks. Patch references are available at Kernel Git Commit 4707344, Kernel Git Commit a62ef2d, and Kernel Git Commit c597c85.

Workarounds

Restrict local access to systems using XFS until patched kernels are deployed
Limit which user accounts can invoke exchange-mappings ioctls on XFS mounts through standard filesystem permissions
Consider mounting non-critical XFS volumes read-only where write access is not required

bash

# Verify running kernel version and XFS module status
uname -r
modinfo xfs | grep -E 'version|filename'

# Check kernel log for XFS-related errors
dmesg -T | grep -iE 'xfs|exchmaps'

# After patching, confirm reboot into the fixed kernel
uptime && uname -r