CVE-2026-64600: Linux Kernel Privilege Escalation Flaw

CVE-2026-64600 Overview

CVE-2026-64600 is a Linux kernel vulnerability in the XFS filesystem's reflink handling code. The flaw resides in the xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc helpers, which operate on inode data fork and copy-on-write (COW) fork mappings. Both helpers cycle the inode lock (ILOCK) to acquire a transaction, which invalidates the mappings once the lock is reacquired. The code refreshes the COW fork mapping but fails to refresh the data fork mapping, causing xfs_bmap_trim_cow to query the refcount btree against stale physical blocks. Direct I/O writes can then proceed using an inaccurate *shared value derived from stale data.

Critical Impact
Direct I/O writes on XFS reflinked files may proceed with stale data fork mappings, risking data integrity issues on affected Linux kernels.

Affected Products

Linux kernel (XFS filesystem subsystem)
Distributions shipping vulnerable stable kernel branches referenced in the upstream commits
Systems using XFS with reflink and direct I/O workloads

Discovery Timeline

2026-07-23 - CVE-2026-64600 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64600

Vulnerability Analysis

The defect is a stale-mapping race in the XFS reflink code path. When XFS handles a COW hole fill or delalloc conversion during reflink operations, the kernel must acquire a transaction. Acquiring the transaction requires releasing and re-acquiring ILOCK, which opens a window where concurrent operations can change the inode's block map.

After the ILOCK cycle, xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc re-query the COW fork mapping through xfs_find_trim_cow_extent. However, the data fork mapping passed into these helpers is not refreshed. Subsequent logic uses this stale mapping to reference physical block numbers that may no longer describe the current file state.

Root Cause

The root cause is a missing consistency check on the data fork mapping after the ILOCK cycle. Because XFS uses a sequence counter to detect changes to the inode's block map while the lock is dropped, the correct pattern is to re-read the data fork mapping when the counter advances. The vulnerable code omits that check, leaving xfs_bmap_trim_cow to consult the refcount btree with outdated physical block information.

Attack Vector

The issue is triggered by concurrent direct I/O and reflink activity on XFS. When xfs_bmap_trim_cow receives stale inputs, it may return *shared = false incorrectly, allowing a direct I/O write to proceed against a data fork mapping that no longer reflects the file's real layout. The upstream fix re-samples the data fork mapping when the sequence counter changes across the ILOCK cycle. See the upstream patch for the corrective logic.

Detection Methods for CVE-2026-64600

Indicators of Compromise

No public indicators of compromise are associated with this kernel defect.
Unexpected data corruption or shared-state inconsistencies on XFS filesystems using reflink and direct I/O may correlate with the flaw.
Kernel warnings or filesystem consistency errors reported by xfs_repair after heavy reflink workloads.

Detection Strategies

Inventory running kernel versions and compare against the fixed commits listed in the kernel.org stable tree.
Query package management data to identify hosts running unpatched kernel builds on XFS-backed workloads.
Correlate filesystem error logs with workloads that combine reflink cloning and direct I/O.

Monitoring Recommendations

Monitor dmesg and journalctl -k for XFS assertions or xfs_bmap warnings.
Track kernel version drift across the fleet and alert on hosts running kernels below the patched revisions.
Watch for anomalous data integrity check failures in workloads relying on cp --reflink or FICLONE semantics.

How to Mitigate CVE-2026-64600

Immediate Actions Required

Identify Linux hosts running kernels that predate the fix commits referenced in the NVD entry.
Apply vendor-supplied kernel updates that incorporate the upstream XFS patch.
Schedule reboots for updated hosts, since kernel patches take effect only after a reboot or live-patch application.

Patch Information

The fix is available in the mainline and stable kernel trees under commits 206c09b0, 2f4acd0f, 44f891bc, and e705d81a. The patch re-samples the data fork mapping when the XFS sequence counter changes across the ILOCK cycle. Distribution-specific backports are tracked in the OSS-Security discussion thread.

Workarounds

Avoid mixing heavy reflink operations with concurrent direct I/O on XFS until patched kernels are deployed.
Use buffered I/O instead of O_DIRECT for workloads that also perform FICLONE or cp --reflink operations, where feasible.
Where XFS reflink is not required, mount filesystems without reflink support to sidestep the affected code paths.

bash

# Verify running kernel version against fixed stable releases
uname -r

# Check whether XFS reflink is enabled on a filesystem
xfs_info /mount/point | grep -i reflink