CVE-2026-98872 - Vulnerability Details

- freevxfs: don't BUG() on unknown typed-extent type

Description

In the Linux kernel, the following vulnerability has been resolved:

freevxfs: don't BUG() on unknown typed-extent type

vxfs_bmap_typed() handles four typed-extent types and calls BUG() in
its default case, so an on-disk typed extent with any other type value
crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular
file:

kernel BUG at fs/freevxfs/vxfs_bmap.c:230!
RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline]
vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257

Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value
vxfs_bmap_typed() already returns on failure (and from the DEV4 case
above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.

Published: 2026-10-23

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The freevxfs filesystem driver in the Linux kernel contains an unhandled switch case in vxfs_bmap_typed() that calls BUG() when an unknown typed‑extent type is encountered. The resulting BUG() causes a kernel panic, immediately crashing the operating system. This crash is a direct denial‑of‑service effect that stops all services and processes on the affected machine.

Affected Systems

Any system running a Linux kernel that includes the freevxfs filesystem module and has at least one freevxfs mounted volume is potentially impacted. The kernel code path is triggered when a regular file on such a volume receives an ioctl(FIBMAP) request that passes an unsupported typed‑extent type value.

Risk and Exploitability

Based on the description, it is inferred that the vulnerability requires local access to a file on a freevxfs volume and the ability to perform the ioctl(FIBMAP) operation. Remote exploitation is unlikely unless an attacker can place a crafted file on the target system or gain local execution rights. The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fe40a19d571cbb584eea46038ee919d8712b2d2c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 500e9d5bf9eff2096a21b7ac25a0a06ca46ab821
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f1f2d54a576f0e4133b979e545abcfefd439c300
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7ada9807e37103b41f586d34e3075e1209182b65
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1284d687d46953fff9c0d969df108114611aca8b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 405f13d7b270913e06e8e2b4de568985f94ef7d6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 704d48d81dc41470e108811c32c577ada66192d4

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fe40a19d571cbb584eea46038ee919d8712b2d2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,500e9d5bf9eff2096a21b7ac25a0a06ca46ab821)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1f2d54a576f0e4133b979e545abcfefd439c300)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ada9807e37103b41f586d34e3075e1209182b65)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1284d687d46953fff9c0d969df108114611aca8b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,405f13d7b270913e06e8e2b4de568985f94ef7d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,704d48d81dc41470e108811c32c577ada66192d4)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fe40a19d571cbb584eea46038ee919d8712b2d2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,500e9d5bf9eff2096a21b7ac25a0a06ca46ab821)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1f2d54a576f0e4133b979e545abcfefd439c300)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ada9807e37103b41f586d34e3075e1209182b65)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1284d687d46953fff9c0d969df108114611aca8b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,405f13d7b270913e06e8e2b4de568985f94ef7d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,704d48d81dc41470e108811c32c577ada66192d4)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel release that replaces BUG() with WARN_ON_ONCE() and gracefully returns from vxfs_bmap_typed()
If an upgrade cannot be applied immediately, unmount all freevxfs volumes or disable the freevxfs module to eliminate the crash vector
Restrict or monitor ioctl(FIBMAP) calls on freevxfs files so that only trusted users can invoke the operation, limiting the opportunity to trigger the bug

Generated by OpenCVE AI on October 26, 2026 at 15:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00213.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98872.mbox
https://git.kernel.org/stable/c/1284d687d46953fff9c0d969df108114611aca8b
https://git.kernel.org/stable/c/405f13d7b270913e06e8e2b4de568985f94ef7d6
https://git.kernel.org/stable/c/500e9d5bf9eff2096a21b7ac25a0a06ca46ab821
https://git.kernel.org/stable/c/704d48d81dc41470e108811c32c577ada66192d4
https://git.kernel.org/stable/c/7ada9807e37103b41f586d34e3075e1209182b65
https://git.kernel.org/stable/c/f1f2d54a576f0e4133b979e545abcfefd439c300
https://git.kernel.org/stable/c/fe40a19d571cbb584eea46038ee919d8712b2d2c
https://nvd.nist.gov/vuln/detail/CVE-2026-98872
https://www.cve.org/CVERecord?id=CVE-2026-98872

History

Mon, 26 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Mon, 26 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98872.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98872 https://www.cve.org/CVERecord?id=CVE-2026-98872
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG() on unknown typed-extent type vxfs_bmap_typed() handles four typed-extent types and calls BUG() in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular file: kernel BUG at fs/freevxfs/vxfs_bmap.c:230! RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline] vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257 Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value vxfs_bmap_typed() already returns on failure (and from the DEV4 case above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.
Title		freevxfs: don't BUG() on unknown typed-extent type
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1284d687d46953fff9c0d969df108114611aca8b https://git.kernel.org/stable/c/405f13d7b270913e06e8e2b4de568985f94ef7d6 https://git.kernel.org/stable/c/500e9d5bf9eff2096a21b7ac25a0a06ca46ab821 https://git.kernel.org/stable/c/704d48d81dc41470e108811c32c577ada66192d4 https://git.kernel.org/stable/c/7ada9807e37103b41f586d34e3075e1209182b65 https://git.kernel.org/stable/c/f1f2d54a576f0e4133b979e545abcfefd439c300 https://git.kernel.org/stable/c/fe40a19d571cbb584eea46038ee919d8712b2d2c

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:11.214Z

Updated: 2026-10-26T06:55:53.758Z

Reserved: 2026-09-25T10:25:14.377Z

Link: CVE-2026-98872

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:20.623

Modified: 2026-10-26T07:17:11.603

Link: CVE-2026-98872

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98872 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-26T16:00:18Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object