CVE-2026-97549 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, XFS filesystem users and administrators, and security teams responsible for Linux kernel and XFS filesystem security should verify the Linux kernel version and XFS filesystem configuration to ensure the fix is applied. They should assess exposure based on the use of XFS filesystems and directory repair operations, and review system logs for signs of the assertion failure.

Why it matters

A vulnerability in the Linux kernel has been identified and resolved, related to the under-reservation of blocks when repairing shortform (sf) directories in XFS. The issue arises from an incorrect setting of `args->total` to 1 in `xrep_dir_swap_prep`, which does not account for the directory block size and filesystem block size.

• Verify Linux kernel version and XFS filesystem configuration to ensure the fix is applied.
• Assess exposure based on the use of XFS filesystems and directory repair operations.
• Review system logs for signs of the assertion failure.

Technical summary

The vulnerability is caused by an incorrect setting of `args->total` to 1 in `xrep_dir_swap_prep`, which does not account for the directory block size and filesystem block size. The fix involves changing the assignment of `args->total` to use `xfs_dabuf_nfsb`, which computes the correct value for directories. This change addresses the under-reservation of blocks when repairing shortform (sf) directories in XFS, preventing potential filesystem shutdowns. Linux kernel developers and maintainers should verify the fix is applied, and XFS filesystem users and administrators should assess their exposure and review system logs.

Defensive priority

Verify the Linux kernel version and XFS filesystem configuration to ensure the fix is applied. Assess exposure based on the use of XFS filesystems and directory repair operations.

Recommended defensive actions

• Verify the Linux kernel version to ensure the fix is applied.
• Assess XFS filesystem configuration and directory repair operations.
• Review system logs for signs of the assertion failure.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The issue was identified through QA on XFS for-next as of 7.3-rc2. The problem is caused by an incorrect setting of `args->total` in `xrep_dir_swap_prep`. The fix involves changing the assignment of `args->total` to use `xfs_dabuf_nfsb`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.