CVE-2026-64600 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-64600HIGH

Linux Linux — xfs: resample the data fork mapping after cycling ILOCK

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0047   39.1     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 –  —
  Linux    4.11 –                                      5.15.212

TIMELINE
  Jul 19  Reserved by Linux
  Jul 23  EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.
  Jul 23  Published (CNA: Linux)
  Aug 18  EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.

CWE-362 · CNA: Linux · CVSS v3.1 · 14 references · NVD status: Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
July 19, 2026	Reserved	Reserved by Linux
July 23, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.
July 23, 2026	Published	Published (CNA: Linux)
August 18, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5	—
Linux	Linux	—	4.11	5.15.212

Weaknesses

CWE-362

References (14)

http://www.openwall.com/lists/oss-security/2026/07/22/14 [Mailing List, Exploit]
http://www.openwall.com/lists/oss-security/2026/07/22/18 [Mailing List]
http://www.openwall.com/lists/oss-security/2026/07/22/19 [Mailing List]
http://www.openwall.com/lists/oss-security/2026/07/31/3 [Mailing List]
http://www.openwall.com/lists/oss-security/2026/08/03/4 [Mailing List]
http://www.openwall.com/lists/oss-security/2026/08/03/8 [Mailing List]
https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt [Exploit, Third Party Advisory]
https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9 [Patch]
https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 [Patch]
https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581 [Patch]
https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f [Patch]
https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05 [Patch]
https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18 [Patch]
https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075 [Patch]

Authoritative record: CVE-2026-64600 at cve.org

Vendors: linux

Weaknesses: CWE-362

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64600 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.