{"id":"CVE-2026-98446","title":"xfs: don't let hidden_space go negative in xfs_metafile_resv_init","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't let hidden_space go negative in xfs_metafile_resv_init\n\nLOLLM points out that if the amount of fdblocks that we can reserve for\na metadata btree file goes be…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < 930a9c1c321efdaa3e7f8caecb0479cee3baf342","Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dc","Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < 476582d754cdc5110f806001417fea6c77824c13","Linux 6.15"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:14:56.724Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98446","references":[{"url":"https://git.kernel.org/stable/c/930a9c1c321efdaa3e7f8caecb0479cee3baf342"},{"url":"https://git.kernel.org/stable/c/f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dc"},{"url":"https://git.kernel.org/stable/c/476582d754cdc5110f806001417fea6c77824c13"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.307Z","slug":"CVE-2026-98446","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't let hidden_space go negative in xfs_metafile_resv_init\n\nLOLLM points out that if the amount of fdblocks that we can reserve for\na metadata btree file goes below the space already used by that file,\nthen the hidden_space subtraction can underflow, causing\nxfs_dec_fdblocks to subtract a huge amount of space.  We never want the\ntarget to be less than the used sapce, so fix the logic that adjusts\ndblocks_avail downwards.\n\nAlso fix an error in the adjacent comment.\n\n## Affected\n\n- `Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < 930a9c1c321efdaa3e7f8caecb0479cee3baf342`\n- `Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dc`\n- `Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < 476582d754cdc5110f806001417fea6c77824c13`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}