Description

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that currently has it to the other file, as long as exactly one side is marked. This assumes that the file contents, and therefore all shared extents, are exchanged. That assumption is not true when XFS_EXCHMAPS_INO1_WRITTEN is set. xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1, so an exchange can complete without moving every mapping that the earlier flag-swap decision accounted for. In that case the post-operation cleanup can clear the reflink flag from an inode that still owns shared written extents. Later writes then take the non-reflink write path and may update blocks that should still have been protected by CoW, which shows up as data corruption between reflink-related files. Fix this by disabling the reflink flag exchange whenever XFS_EXCHMAPS_INO1_WRITTEN is requested. The contents exchange can still proceed; the conservative outcome is that both inodes keep the reflink flag. The regular reflink flag cleanup path can drop the extra flag later once the inode no longer has shared extents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-26T15:17:06.990Z",
  "pubdate": "2026-08-26T15:17:06.990Z",
  "executiveSummary": "A logic flaw exists in the XFS file system's range exchange implementation, specifically concerning how reflink flags are managed during file range operations.\nThe vulnerability occurs when XFS_EXCHMAPS_INO1_WRITTEN is utilized, leading to an incorrect clearing of the reflink inode flag.\nThis behavior can result in data corruption for reflink-related files because subsequent writes may bypass necessary Copy-on-Write (CoW) protections.\nThe vulnerability affects the Linux kernel's XFS module. It poses a significant risk to data integrity for systems leveraging reflink-based features, such as snapshots or deduplication.\nExploitation does not require network access but does require local access to manipulate file ranges via specific exchange operations.\nThe primary risk is silent data corruption, as the kernel incorrectly assumes an inode no longer shares extents when it actually does.",
  "technicalDetails": "The root cause lies in a flawed decision-making process within xmi_can_exchange_reflink_flags() during the exchange of two file ranges. Historically, the system assumes that exchanging file ranges inherently means all shared extents are also exchanged, justifying the migration of the reflink inode flag from one file to another if only one side possesses it.\nThis logic fails when the XFS_EXCHMAPS_INO1_WRITTEN flag is active. When this flag is set, xfs_exchmaps_can_skip_mapping() allows the file system to bypass hole and unwritten mappings during the exchange. Consequently, the exchange operation may terminate without actually migrating all the mappings that the initial flag-swap logic relied upon.\nAs a result of this mismatch, the post-operation cleanup routine prematurely clears the reflink flag from an inode that remains the owner of shared written extents. This clears the S_I_REFLINK state, which is critical for the kernel to distinguish between standard files and those that require Copy-on-Write (CoW) safety.\nThe subsequent exploitation path follows a predictable pattern: 1) An attacker or a legitimate user triggers an XFS_EXCHMAPS_INO1_WRITTEN range exchange. 2) The system incorrectly clears the reflink flag on an inode that still maintains shared extents. 3) The kernel's write path identifies the file as a non-reflink file due to the cleared flag. 4) The write path executes a direct block update instead of invoking the required CoW logic.\nThis leads to direct data corruption because the write operation modifies blocks that are logically shared with other files, violating the immutability requirements of the shared extents. The post-exploitation impact is the loss of data consistency and integrity for the affected files, which may manifest as silent corruption within the file system.\nThis vulnerability resides in the XFS kernel module's exchange range implementation logic and affects kernels implementing recent reflink exchange functionality. It requires no specific authentication beyond what is already needed to perform range exchange operations (typically user-level access to the file system)."
}