CVE-2026-97548 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify fixes. This includes reviewing Linux kernel versions and XFS file system usage, verifying fixes, and updating to fixed kernel versions if necessary. The vulnerability's impact on system stability and security necessitates a thorough review of affected systems and prompt application of fixes.

Why it matters

A vulnerability in the Linux kernel's XFS file system has been addressed. Linux kernel maintainers and users should assess exposure and verify fixes.

• Verify Linux kernel versions and XFS file system usage
• Assess exposure and potential access beyond cursor bounds
• Update to fixed kernel versions if necessary

Technical summary

The rtrmap and rtrefcount _maxlevels_ondisk functions in the Linux kernel's XFS file system did not account for the inode root. This could potentially allow access beyond the end of a cursor for a sufficiently large btree. The issue has been addressed through fixes to these functions. The fixes ensure that the functions accurately compute the size of in-memory btree cursors, preventing potential access beyond cursor bounds. This vulnerability impacts Linux kernel maintainers, users, and administrators who need to assess exposure and verify fixes.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify fixes.

Recommended defensive actions

• Review Linux kernel versions and XFS file system usage
• Verify fixes and assess exposure
• Update to fixed kernel versions if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Three source references from the Linux kernel Git repository are available. The evidence is grounded in official CVE and NVD documentation, as well as source references from the Linux kernel Git repository. The vulnerability's scope and impact are still being assessed, and defenders should verify Linux kernel versions and XFS file system usage. The fixes involve updating the _maxlevels_ondisk functions to correctly account for the inode root, thereby preventing out-of-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.