Description

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_rtginode_load xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded. Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-26T15:17:08.017Z",
  "pubdate": "2026-08-26T15:17:08.017Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel XFS filesystem implementation within the xfs_rtginode_ensure() function. The flaw stems from improper error propagation, where specific failure conditions during the loading of realtime group inodes are erroneously treated as successful operations.\nThe vulnerability type is an Improper Error Handling flaw, which can lead to filesystem inconsistencies and potential data corruption. By failing to check for errors other than -ENOENT, the kernel permits the growfs operation to proceed despite the realtime inode being in an uninitialized or corrupted state.\nThis impacts the reliability and integrity of the XFS filesystem on Linux systems. An attacker capable of triggering specific filesystem I/O errors or inducing corruption could potentially bypass stability checks. The risk implication involves filesystem state divergence, which may lead to kernel panics or permanent storage corruption if the filesystem state is improperly managed after an unsuccessful load attempt.\nExploitation requires the ability to interact with the XFS filesystem and trigger error conditions during realtime inode operations, typically requiring privileged access to the storage volume or the ability to manipulate the underlying block device.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic within xfs_rtginode_ensure(). In the Linux kernel XFS implementation, this function attempts to load the realtime group inode via xfs_rtginode_load().\nUnder current design, xfs_rtginode_ensure() explicitly checks if the return value of xfs_rtginode_load() is -ENOENT, which indicates the inode does not exist and should be created. However, the logic fails to account for other negative return values, such as those representing I/O errors (-EIO), memory allocation failures (-ENOMEM), or structural corruption markers.\nBecause the function treats any return value other than -ENOENT as a success state, the caller—specifically the growfs routine—proceeds under the assumption that the realtime group inode is valid and accessible. If an error occurred that prevented the inode from being loaded, the inode remains unset or retains stale/invalid pointers.\nThe attack flow follows this sequence: 1) The user or system initiates a growfs operation on an XFS volume. 2) The kernel calls xfs_rtginode_ensure() to retrieve the realtime inode. 3) A transient I/O fault or data corruption occurs, causing xfs_rtginode_load() to return a negative error code (e.g., -EIO). 4) xfs_rtginode_ensure() improperly evaluates this result as non-negative or ignores the non-ENOENT error, returning success to the growfs caller. 5) growfs proceeds, interacting with a NULL or uninitialized inode structure.\nThis leads to a post-exploitation impact characterized by kernel-level memory corruption or invalid pointer dereferences. When growfs performs subsequent operations (such as allocation or metadata modification) using the expected but uninitialized realtime inode, the kernel may encounter a null pointer dereference or write metadata to incorrect memory addresses, causing immediate system instability or silent corruption of the filesystem journal and metadata headers.\nThis flaw is specific to the XFS realtime group management subsystem. While it does not inherently provide a path for remote code execution, it represents a significant local denial-of-service vector and a mechanism for integrity compromise of the storage layer. Privilege requirements are inherently tied to filesystem management permissions, typically requiring root or equivalent administrative rights to mount or perform maintenance operations like growfs."
}