CVE-2026-97551 Linux CVE debrief

Who should care

Linux administrators, security teams, and teams responsible for maintaining Linux-based systems should assess exposure and prioritize verification of Linux kernel versions and XFS filesystem usage.

Why it matters

Linux administrators and security teams should assess exposure and prioritize verification of Linux kernel versions and XFS filesystem usage to prevent potential denial of service and data loss.

• Denial of service due to filesystem shutdown
• Potential data loss or corruption due to unavailability of filesystem

Technical summary

The vulnerability is in the XFS filesystem implementation in the Linux kernel. The `xfs_parent_da_args_init` function does not initialize the `args->total` field, which can cause issues with block reservations and lead to a filesystem shutdown. This can happen when an allocation is attempted in an AG with zero available blocks, causing the `xfs_da_grow_inode_int` function to wrap the `args->total` field to ~0U, defeating the free-space check in `xfs_alloc_space_available`. As a result, the allocation returns -ENOSPC, leading to a filesystem shutdown. Linux administrators and security teams should assess exposure and prioritize verification of Linux kernel versions and XFS filesystem usage.

Defensive priority

Linux administrators and security teams should assess exposure and prioritize verification of Linux kernel versions and XFS filesystem usage.

Recommended defensive actions

• Verify Linux kernel versions and XFS filesystem usage
• Review and apply patches or updates from Linux vendors
• Monitor system logs for potential denial-of-service attempts
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Review asset inventory for systems that may be affected by this vulnerability
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the XFS filesystem implementation in the Linux kernel. The `xfs_parent_da_args_init` function does not initialize the `args->total` field, which can cause issues with block reservations and lead to a filesystem shutdown. Linux administrators and security teams should verify Linux kernel versions and XFS filesystem usage to assess exposure. The scope of affected versions and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.