Description

In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions The _maxlevels_ondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount versions of these functions forget to account for the inode root, which means that we could access beyond the end of the cursor given a sufficiently large btree. Fix this.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:05.183Z",
  "pubdate": "2026-09-25T11:17:05.183Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel XFS filesystem implementation involving the calculation of btree cursor dimensions. Specifically, the rtrmap and rtrefcount btree cursor initialization functions fail to account for the inode root component when calculating maximum tree depth.\nThis flaw results in an incorrect sizing of in-memory btree cursors. If a filesystem maintains a sufficiently large btree structure, the cursor allocation will be insufficient, leading to an out-of-bounds memory access scenario.\nThe vulnerability affects XFS systems utilizing real-time reverse mapping (rtrmap) or real-time reference counting (rtrefcount) btrees. Successful exploitation of this memory corruption vulnerability could lead to kernel-level data corruption, system instability, or potential arbitrary code execution depending on the heap layout.\nThe attack is localized to the kernel's memory management of XFS structures and requires an attacker to possess sufficient privileges to manipulate XFS filesystem structures, such as creating or modifying files on a specially crafted or corrupted XFS volume. Given the nature of filesystem drivers, this typically requires local access or the ability to mount an untrusted filesystem image.",
  "technicalDetails": "The root cause of this vulnerability lies in the incorrect implementation of the _maxlevels_ondisk functions for the rtrmap and rtrefcount btrees within the XFS kernel driver. These functions are responsible for determining the maximum height of a btree to allocate the appropriate buffer size for the in-memory btree cursor (struct xfs_btree_cur).\nIn the Linux kernel's XFS implementation, a btree cursor tracks the current path through the tree. The cursor must be sized to accommodate the maximum possible depth of the tree, which includes the root node stored within the inode (the 'inode root') and the subsequent levels stored on disk blocks. The identified functions omitted the inode root layer from their calculation. Consequently, when the btree grows to a depth that approaches the calculated maximum, the internal cursor state tracking pointers can exceed the memory bounds allocated for the cursor.\nThe exploitation flow proceeds as follows: An attacker creates an XFS filesystem with the real-time feature enabled. By performing specific allocation or refcount operations that force the growth of the rtrmap or rtrefcount btrees, the attacker causes the kernel to instantiate a btree cursor. Because the cursor was allocated based on an underestimated depth, the kernel's btree navigation logic will eventually attempt to write or read cursor state data to an index beyond the allocated memory area during tree traversal. This constitutes a heap-based out-of-bounds access.\nThe vulnerable components are specifically the rtrmap and rtrefcount btree implementation logic in the Linux kernel XFS codebase. Because these structures are kernel-resident and operate with high privileges, triggering an out-of-bounds access allows an attacker to overwrite adjacent kernel memory structures. If the memory allocator places sensitive structures (such as function pointers or kernel objects) near the btree cursor buffer, an attacker could potentially achieve control flow hijacking. The impact is significant, as filesystem drivers operate with elevated privileges, and memory corruption at this layer generally results in a kernel panic (Denial of Service) or potential privilege escalation if a specific heap grooming strategy is employed to overwrite targeted control data structures."
}