CVERadar
HIGH · CVSS 3.1 7.8Public PoCEPSS 0.47% (p40)Threat level 43

CVE-2026-64600: CVE-2026-64600: In the Linux kernel, the following vulnerability has been resolved: xfs: resample the dat…

linux · linux kernel · NVD published 2026-07-23 · posted 2026-07-23 · last modified 2026-10-20

What it is

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

WeaknessCWE-362
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)
ATT&CK tacticsn/a

Exploitation evidence

First exploit evidence seen: 2026-07-23 (earliest date across the sources below).

Exploited in the wild

No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).

Public exploit code

GitHub proof-of-concept repositories

10 public repositories from 10 accounts, first seen 2026-07-23. Most starred: 0xBlackash/CVE-2026-64600 (21 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: nomi-sec/PoC-in-GitHub.

How to fix it

Fixed versions

  • linux linux kernel: upgrade to 5.15.212 or later (affected from 4.11)
  • linux linux kernel: upgrade to 6.1.178 or later (affected from 5.16)
  • linux linux kernel: upgrade to 6.6.145 or later (affected from 6.2)
  • linux linux kernel: upgrade to 6.12.96 or later (affected from 6.7)
  • linux linux kernel: upgrade to 6.18.39 or later (affected from 6.13)
  • linux linux kernel: upgrade to 7.1.4 or later (affected from 6.19)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

Detection Generic guidance

    Response checklist Generic guidance

    1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
    2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
    3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
    4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

    Sources