CVE-2026-98447

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots

LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory corruption of whatever's beyond the buffers.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 18, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-98448In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that CVE-2026-98449In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sCVE-2026-98450In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_CVE-2026-984518.8In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT opCVE-2026-98452In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() CVE-2026-98453In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_opCVE-2026-984548.1In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contextCVE-2026-98455In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNICVE-2026-984567.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_indeCVE-2026-98457In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access CVE-2026-98458In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bindCVE-2026-98459In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_lin
CVE-2026-98447: Unscored | Vulnix