---
id: CVE-2026-98446
title: 'xfs: don''t let hidden_space go negative in xfs_metafile_resv_init'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: don't let hidden_space go negative in xfs_metafile_resv_init

  LOLLM points out that if the amount of fdblocks that we can reserve for
  a metadata btree file goes be…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 <
    930a9c1c321efdaa3e7f8caecb0479cee3baf342
  - >-
    Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 <
    f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dc
  - >-
    Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 <
    476582d754cdc5110f806001417fea6c77824c13
  - Linux 6.15
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:14:56.724Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98446'
references:
  - url: 'https://git.kernel.org/stable/c/930a9c1c321efdaa3e7f8caecb0479cee3baf342'
  - url: 'https://git.kernel.org/stable/c/f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dc'
  - url: 'https://git.kernel.org/stable/c/476582d754cdc5110f806001417fea6c77824c13'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.307Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't let hidden_space go negative in xfs_metafile_resv_init

LOLLM points out that if the amount of fdblocks that we can reserve for
a metadata btree file goes below the space already used by that file,
then the hidden_space subtraction can underflow, causing
xfs_dec_fdblocks to subtract a huge amount of space.  We never want the
target to be less than the used sapce, so fix the logic that adjusts
dblocks_avail downwards.

Also fix an error in the adjacent comment.

## Affected

- `Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < 930a9c1c321efdaa3e7f8caecb0479cee3baf342`
- `Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < f0d8352a39f4a2e329ae45b71bb0d49e2ca0a6dc`
- `Linux >= 1df8d75030b787a9fae270b59b93eef809dd2011 < 476582d754cdc5110f806001417fea6c77824c13`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.