Exploit Total
ExploreInsightsHow it worksContact us
bySign in

© 2026 Anyday Security

FAQPrivacy PolicyTerms of Use

Product names, logos and brands are property of their respective owners. They are used here for identification only and imply no affiliation or endorsement.

ExploreInsightsHow it worksContact us
Back
Vulnerability ID

CVE-2026-64600

Race condition in xfs

ProductLinux kernel
CVSS 3.1High7.8
EPSS0.47%
Has public PoCNo
AI Exploitability

No working AI exploit yet

Working AI PoC
Not yet
Cheapest run
$15.71
Fastest run
—
Model MatrixCapability BreakdownVulnerability DetailsTimelineCommunity
Sign in
Model MatrixCapability BreakdownVulnerability DetailsTimelineCommunity

Overview

View on NVD

xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared.

CWE
CWE-362
Weakness
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Component
xfs
Impact
Not stated
Published
2026-07-23
Fixed version
7.2

Risk factors

In-the-WildNot observed
CISA KEVNot listed
Public ExploitNone known
Ransomware useNone known

Severity

CVSS 3.1Only version published

7.8High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Attack VectorLocal
ComplexityLow
Privileges RequiredLow
User InteractionNone
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

EPSS

Chance of exploitation in the next 30 days

0.47%

SSVC

Stakeholder-specific vulnerability categorization

Not scored. CISA publishes an SSVC decision for a subset of CVEs.