CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xfs: resample the data fork mapping after cycling ILOCK

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping.  Unfortunately, these two
helpers cycle the ILOCK to grab a transaction, which means that the
mappings are stale as soon as we reacquire the ILOCK.  Currently we
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
we don't refresh the data fork mapping beforehand, which means that the
xfs_bmap_trim_cow in that function queries the refcount btree about the
wrong physical blocks and returns an inaccurate value in *shared.

If *shared is now false, the directio write proceeds with a stale data
fork mapping.  Fix this by querying the data fork mapping if the
sequence counter changes across the ILOCK cycle.

The Linux kernel CVE team has assigned CVE-2026-64600 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 and fixed in 6.12.96 with commit e705d81a7193dd19e69b8e2bad4696d78a4ea075
	Issue introduced in 4.11 with commit 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 and fixed in 6.18.39 with commit 206c09b04dc5469c7ff14d8aceff2d47c88078d9
	Issue introduced in 4.11 with commit 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 and fixed in 7.1.4 with commit 44f891bc088958399eec27f7604928694aa35581
	Issue introduced in 4.11 with commit 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 and fixed in 7.2-rc4 with commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64600
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/xfs/xfs_reflink.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075
	https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9
	https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581
	https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7