CVE-2026-64357
In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added. The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.
Affected versions
Linux kernel versions
6.10
and later are affected. Fixed in
6.12.96,
6.18.39,
7.1.4,
7.2-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-64357?
CVE-2026-64357 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.10 onward and has been patched in 6.12.96, 6.18.39, 7.1.4 and others. CVE-2026-64357 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64357?
Yes. CVE-2026-64357 has been patched. Fixed versions include 6.12.96, 6.18.39, 7.1.4 and others. If you are running Linux kernel 6.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64357 actively exploited?
No. CVE-2026-64357 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.