Cloudanix VulnDB

CVE-2026-98872

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles certain filesystem data can let a local user crash the whole computer by sending a special command to a file.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The freevxfs vxfs_bmap_typed function calls BUG() on an unrecognized typed-extent value read from disk, reachable via FIBMAP ioctl on a regular file, resulting in immediate kernel panic.

Why it matters to the business

Local users can trigger kernel crashes on systems mounting freevxfs volumes, causing denial of service, potential data corruption, and unplanned downtime with no known ransomware or targeted actor usage.

How an attack unfolds

An attacker with local access creates or supplies a freevxfs filesystem image containing an on-disk extent with an unrecognized type value, then issues FIBMAP ioctl against a file on that volume to reach the vulnerable code path and panic the kernel.

How to fix it

Upgrade to a Linux kernel containing the fix that replaces BUG() with WARN_ON_ONCE() and returns 0 from vxfs_bmap_typed; apply the patch or newer kernel release that addresses this issue.

How to confirm the fix worked

Verify the running kernel contains the commit replacing BUG() with WARN_ON_ONCE in fs/freevxfs/vxfs_bmap.c and test that FIBMAP ioctl on a malformed extent returns -EIO instead of panicking.

Typical attack path

  1. Mount a freevxfs filesystem containing a crafted typed extent
  2. Open a regular file on the mounted volume
  3. Invoke FIBMAP ioctl on the file descriptor
  4. Trigger vxfs_bmap_typed default case leading to BUG()

How to detect it

Search kernel logs for BUG messages containing vxfs_bmap_typed or vxfs_bmap.c:230; examine audit logs for FIBMAP ioctl calls on freevxfs filesystems.

What your security team should do

  • Prioritize kernel updates for any systems exposing freevxfs mounts to untrusted local users
  • Restrict unprivileged use of FIBMAP ioctl via seccomp or LSM policies where possible
  • Monitor for kernel BUG reports referencing vxfs_bmap.c in system logs

The record

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG() on unknown typed-extent type vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file: kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257 Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.

Affected packages

Ecosystem Package Introduced Fixed