CVE-2026-97551 xfs: initialise args->total for parent pointer updates
An integer overflow in XFS parent pointer updates causes filesystem shutdown, leading to denial of service for local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97551?
CVE-2026-97551 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: initialise args->total for parent pointer updates
xfs_parent_da_args_init() builds an xfs_da_args from a zeroed xfs_parent_args (kmem_cache_zalloc), leaving args->total == 0. xfs_da_grow_inode_int() treats that field as a running block reservation and subtracts from it; because it is an xfs_extlen_t (uint32_t), the first attr-fork growth wraps it to ~0U. That defeats the free-space check in xfs_alloc_space_available(), and when it coincides with an AG that has exactly zero available blocks the allocation is clamped to maxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates to a filesystem shutdown.
Set args->total the way the log recovery path does (xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace paths that can grow the fork. Removals and lookups never grow it, so they leave the field alone, matching that switch.
Which versions are affected by CVE-2026-97551?
How do I fix CVE-2026-97551?
Apply the vendor's patch.
Is CVE-2026-97551 being exploited?
There is no known exploitation of CVE-2026-97551 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97551, DEBIAN-CVE-2026-97551, GHSA-hph3-hwfc-67wh, UBUNTU-CVE-2026-97551.