Vulnerability feed

Executive summary

A flaw in the Linux kernel's XFS file system code can cause a file that shares data with another file to be overwritten in place instead of copied, corrupting the other file. The advisory does not state a severity score or whether the flaw is being actively exploited. The advisory describes a fix that stops the exchange path from clearing the reflink flag, but it does not name specific fixed kernel versions in the text provided.

Technical summary

This is an integrity flaw in the XFS file system's exchange-range and swapext handling, where the reflink (shared block) flag is wrongly moved or cleared when mappings are exchanged. When an exchange covers both files from offset 0 to i_disk_size, the flag is handed to the other file even though shared blocks may remain past i_disk_size, so a later write happens in place instead of copy-on-write and alters the file sharing those blocks. The advisory says the fix stops moving reflink flags, sets the flag on both inodes for XFS_IOC_SWAPEXT, and ensures both have a CoW fork. Attack vector, required privileges, affected and fixed version numbers, workarounds, and detection guidance are not stated in the provided text.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxXFSLinuxLinux kernelXFS