In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange… (CVE-2026-98975)

The Linux kernel vulnerability CVE-2026-98975 concerns the XFS filesystem's handling of reflink flags during extent exchange operations. When exchanging extents covering files from offset 0 to i_disk_size, the function xmi_can_exchange_reflink_flags() incorrectly assumed all mappings were moved and transferred the reflink flag to the other file. However, files can own shared blocks beyond i_disk_size, which leads to clearing the reflink flag prematurely. This causes subsequent writes to shared blocks to occur in place rather than using copy-on-write, resulting in corruption of the other file sharing those blocks. The fix involves stopping the movement of reflink flags during exchanges, relying instead on xfs_exchmaps_ensure_reflink() to set flags on both inodes before exchange. For the XFS_IOC_SWAPEXT operation, the patch sets reflink flags on both inodes and ensures both have copy-on-write forks, preventing loss of reflink flags. The reflink flags now persist until removed by specific operations like FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or truncation to zero.

The vulnerability can lead to data corruption in files sharing reflinked extents due to improper clearing of reflink flags during extent exchange operations. Writes to shared blocks may occur in place instead of copy-on-write, corrupting data in the other file sharing those blocks. This affects the integrity of data stored on XFS filesystems using reflinks and extent exchange features.

A fix has been implemented in the Linux kernel that stops exchanging reflink flags during extent exchange operations and ensures both inodes retain the reflink flag correctly. Users should update to the Linux kernel version containing commit a23eca88448e or later where this issue is resolved. No additional mitigation is required as the patch addresses the root cause.