In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch… (CVE-2026-98974)

The vulnerability in the Linux kernel's XFS filesystem concerns the XFS_IOC_EXCHANGE_RANGE ioctl's TO_EOF flag. The bug causes the exchange-range operation to incorrectly modify file sizes, allowing files to have shared blocks beyond EOF, which violates filesystem semantics. This occurs because the code swaps on-disk and in-core file sizes incorrectly when a nonzero offset is used. As a result, a second exchange-range call mistakenly clears the reflink flag on files that still share blocks, enabling writes to overwrite shared blocks past EOF. The patch corrects the handling of file sizes during exchange-range operations to prevent this inconsistent state and the associated data corruption risk.

The vulnerability can cause files to have shared data blocks beyond their reported EOF, which is not allowed. This leads to incorrect clearing of reflink flags, enabling writes to overwrite shared blocks improperly. The impact is potential data corruption or loss due to filesystem inconsistencies. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A patch has been released to fix the incorrect file size handling in the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. Users should apply the official Linux kernel update that includes this fix. No other mitigations are indicated or necessary once the patch is applied.