Re: [LTP] cve: reproducer for cve-2026-64600

Re: [LTP] cve: reproducer for cve-2026-64600

[linuxtestproject.agent]

Hi Andrea,

On Fri, 24 Jul 2026, Andrea Cervesato wrote:
> cve: reproducer for cve-2026-64600

> diff --git a/testcases/kernel/fs/xfs/Makefile b/testcases/kernel/fs/xfs/Makefile
> new file mode 100644
> +top_srcdir			?= ../../../..
> +
> +include $(top_srcdir)/include/mk/testcases.mk
> +
> +LDLIBS			+= -lpthread
> +
> +include $(top_srcdir)/include/mk/generic_leaf_target.mk

Every existing standalone CVE reproducer named cve-<id>.c
(cve-2014-0196, cve-2016-7042, cve-2025-38236, cve-2026-46331, ...)
already lives under testcases/cve/, whose Makefile builds every
target from a wildcard and already carries per-target LDLIBS/CFLAGS
overrides (e.g. "-pthread" for other threaded reproducers), plus its
own .gitignore.

Is there a reason this one needs a brand-new
testcases/kernel/fs/xfs/ directory instead of adding
"cve-2026-64600: LDLIBS += -lpthread" to the existing
testcases/cve/Makefile?

Separately, this Makefile is also missing the
"SPDX-License-Identifier: GPL-2.0-or-later" + Copyright header that
every leaf Makefile is expected to start with.

> diff --git a/testcases/kernel/fs/xfs/cve-2026-64600.c b/testcases/kernel/fs/xfs/cve-2026-64600.c
> +	.filesystems = (struct tst_fs []) {
> +		{.type = "xfs"},
> +		{}
> +	},

testcases/kernel/syscalls/ioctl/ioctl_ficlone03.c's xfs entry sets
.min_kver = "4.16", .mkfs_ver = "mkfs.xfs >= 1.5.0" and .mkfs_opts =
{"-m", "reflink=1", NULL}, since reflink is only guaranteed once the
xfsprogs version/format enables it. Here the xfs entry has none of
that. On a system where mkfs.xfs does not default to reflink=1,
would setup() just TCONF through the EOPNOTSUPP/EINVAL/ENOSYS branch
instead of exercising the race, or is the plain default considered
reliable enough these days?

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve: reproducer for cve-2026-64600

[Cyril Hrubis]

Hi!
> > diff --git a/testcases/kernel/fs/xfs/Makefile b/testcases/kernel/fs/xfs/Makefile
> > new file mode 100644
> > +top_srcdir			?= ../../../..
> > +
> > +include $(top_srcdir)/include/mk/testcases.mk
> > +
> > +LDLIBS			+= -lpthread
> > +
> > +include $(top_srcdir)/include/mk/generic_leaf_target.mk
> 
> Every existing standalone CVE reproducer named cve-<id>.c
> (cve-2014-0196, cve-2016-7042, cve-2025-38236, cve-2026-46331, ...)
> already lives under testcases/cve/, whose Makefile builds every
> target from a wildcard and already carries per-target LDLIBS/CFLAGS
> overrides (e.g. "-pthread" for other threaded reproducers), plus its
> own .gitignore.
> 
> Is there a reason this one needs a brand-new
> testcases/kernel/fs/xfs/ directory instead of adding
> "cve-2026-64600: LDLIBS += -lpthread" to the existing
> testcases/cve/Makefile?

I would say that the file should be called reflux-xfs.c instead. I would
like to avoid the filenames with cve and numbers since they are hard
easy to confuse with each other.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve: reproducer for cve-2026-64600

[Andrea Cervesato via ltp]

Hi Cyril,

> I would say that the file should be called reflux-xfs.c instead. I would
> like to avoid the filenames with cve and numbers since they are hard
> easy to confuse with each other.

that's ok. should I move it under cve/ folder instead? Maybe having a
xfs/ directory is a bit an overkill.

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve: reproducer for cve-2026-64600

[Cyril Hrubis]

Hi!
> > I would say that the file should be called reflux-xfs.c instead. I would
> > like to avoid the filenames with cve and numbers since they are hard
> > easy to confuse with each other.
> 
> that's ok. should I move it under cve/ folder instead? Maybe having a
> xfs/ directory is a bit an overkill.

That would work as well, we have a couple of named CVEs in there too.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve: reproducer for cve-2026-64600

[linuxtestproject.agent]

Hi Andrea,

On 2026-07-24, Andrea Cervesato wrote:
> cve: reproducer for cve-2026-64600

> +static void cleanup(void)
> +{
> +	stop_pressure_threads();
> +
> +	if (barrier_initialized)
> +		SAFE_PTHREAD_BARRIER_DESTROY(&barrier);
> +
> +	if (target_dio_fd != -1)
> +		SAFE_CLOSE(target_dio_fd);
> +
> +	if (target_fd != -1)
> +		SAFE_CLOSE(target_fd);
> +
> +	if (clone_fd != -1)
> +		SAFE_CLOSE(clone_fd);
> +
> +	free(tbuf);
> +	free(wbuf);
> +	free(rbuf);
> +}

The header comment says "Root privilege is regained in cleanup() so
the library can unmount the loop device", but cleanup() never calls
SAFE_SETEUID(0)/SAFE_SETEGID(0). setup() drops to "nobody" via
drop_privileges() and nothing restores euid/egid afterwards.

Other tests that drop privileges the same way restore them in
cleanup(), e.g. chmod06.c, acct01.c, creat06.c all call
SAFE_SETEUID(0) there. Per capabilities(7), effective capabilities are
cleared once euid moves away from 0, so the process is still
unprivileged when cleanup() returns. The library's subsequent unmount
of the loop device would then fail with EPERM, leaving the mount and
loop device attached.

Is a SAFE_SETEUID(0) (and SAFE_SETEGID(0)) call missing at the start
of cleanup()?

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve: reproducer for cve-2026-64600

[linuxtestproject.agent]

Hi Andrea,

On Fri, 31 Jul 2026, Andrea Cervesato wrote:
> cve: reproducer for cve-2026-64600

> 	while (!stop_pressure) {
> 		SAFE_PWRITE(1, fd, wbuf, blksize, 0);
> 		SAFE_FTRUNCATE(fd, 0);
> 		SAFE_FSYNC(fd);
> 	}

Could the write be synced before the truncate? The truncate can discard the
dirty page and delayed allocation before writeback, so fsync() only persists
the empty file. This also differs from the documented
write/fdatasync/truncate sequence and may leave the XFS log without the
allocation pressure needed to widen the vulnerable window, causing false
passes on affected kernels.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3] cve: reproducer for cve-2026-64600

[Petr Vorel]

Hi Andrea,

...
> diff --git a/testcases/cve/refluxfs b/testcases/cve/refluxfs
> deleted file mode 100755
> index 42441528e8bbe31ee745881fdf91aa29d5b38adb..0000000000000000000000000000000000000000
> GIT binary patch
> literal 0
> HcmV?d00001

> literal 864544
> zcmeEvd0bW1`u+yxMr9o;E1IdO%$o%^X-RPuZim7`kuog-5yA-x4yN5o6zF;)ie|IP
> ztb4PW#>=rfVh(5{*<_<+(?%MoZf1Im-}Ag{uYDH7?%wa;zkB>__kP~J*1O*KUGG}!
...

I dared to remove this unrelated binary file separately, please repost rebased new version.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3] cve: reproducer for cve-2026-64600

[Andrea Cervesato via ltp]

Hi Petr,

> > literal 864544
> > zcmeEvd0bW1`u+yxMr9o;E1IdO%$o%^X-RPuZim7`kuog-5yA-x4yN5o6zF;)ie|IP
> > ztb4PW#>=rfVh(5{*<_<+(?%MoZf1Im-}Ag{uYDH7?%wa;zkB>__kP~J*1O*KUGG}!
> ...
> 
> I dared to remove this unrelated binary file separately, please repost rebased new version.

yes this is ridiculous :) will remove it before merge.

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3] cve: reproducer for cve-2026-64600

[Martin Doucha]

Hi,
I've test tested this reproducer on affected kernel v6.4 both with and 
without the pressure threads. The version with pressure threads 
commented out was actually 3 times faster in reproducing the race. I 
recommend removing the pressure threads entirely.

One more comment below.

On 7/31/26 09:08, Andrea Cervesato wrote:
> From: Andrea Cervesato <andrea.cervesato@suse.com>
> 
> Reproducer for CVE-2026-64600 ("RefluXFS"), a race condition in the XFS
> reflink copy-on-write path for direct I/O writes. The bug was introduced
> in kernel v4.11 by commit 3c68d44a2b49 ("xfs: allocate direct I/O COW
> blocks in iomap_begin") and fixed by commit 2f4acd0fcd86 ("xfs: resample
> the data fork mapping after cycling ILOCK").
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
> This reproducer has been created with the usage of Kimi K3 (as analyzer
> and writer) and DeepSeek v4 Flash (Max) as reviewer, by taking the
> RefluXFS technical paper as input:
> https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt
> 
> On bugged kernel:
> 
> tst_test.c:2047: TINFO: LTP version: 20260529-131-gd12a6186b
> tst_test.c:2050: TINFO: Tested kernel: 7.2.0-rc1-virtme #21 SMP PREEMPT_DYNAMIC Fri Jul 24 10:20:05 CEST 2026 x86_64
> tst_kconfig.c:90: TINFO: Parsing kernel config '/lib/modules/7.2.0-rc1-virtme/build/.config'
> tst_test.c:1875: TINFO: Overall timeout per run is 0h 00m 30s
> cve-2026-64600.c:233: TFAIL: round 0: racing O_DIRECT write to the clone succeeded
> [    1.252815] cve-2026-646
> HINT: You _MAY_ be missing kernel fixes:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2f4acd0fcd86
> 
> HINT: You _MAY_ be vulnerable to CVE(s):
> 
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64600
> 
> Summary:
> passed   0
> failed   1
> broken   0
> skipped  0
> warnings 0
> 
> On patched kernel:
> 
> tst_test.c:2047: TINFO: LTP version: 20260529-131-gd12a6186b
> tst_test.c:2050: TINFO: Tested kernel: 7.2.0-rc1-virtme #20 SMP PREEMPT_DYNAMIC Fri Jul 24 10:08:53 CEST 2026 x86_64
> tst_kconfig.c:90: TINFO: Parsing kernel config '/lib/modules/7.2.0-rc1-virtme/build/.config'
> tst_test.c:1875: TINFO: Overall timeout per run is 0h 00m 30s
> [    1.665909] clocksource: Watchdog remote CPU 2 read timed out
> [    8.099229] cve-2026-64600 (249) used greatest stack depth: 12216 bytes left
> cve-2026-64600.c:242: TPASS: Source file survived racing O_DIRECT writers
> 
> Summary:
> passed   1
> failed   0
> broken   0
> skipped  0
> warnings 0
> ---
> Changes in v3:
> - use fuzzy loop
> - get blksize from stat()
> - remove cleanup sentence in the description
> - Link to v2: https://lore.kernel.org/20260724-cve-2026-64600-v2-1-c039960448f6@suse.com
> 
> Changes in v2:
> - rename refluxfs.c
> - ensure reflink=1 for mkfs.xfs
> - remove root restore
> - Link to v1: https://lore.kernel.org/20260724-cve-2026-64600-v1-1-8fa214385d2e@suse.com
> ---
>   runtest/cve              |   1 +
>   testcases/cve/.gitignore |   1 +
>   testcases/cve/refluxfs   | Bin 864544 -> 0 bytes
>   testcases/cve/refluxfs.c | 280 +++++++++++++++++++++++++++++++++++++++++++++++
>   4 files changed, 282 insertions(+)
> 
> diff --git a/runtest/cve b/runtest/cve
> index 99d84270b6efc9afae5bd27adee704603c3092f7..12e614502e9ccd2ef27f9d59ab4f7109c68d8883 100644
> --- a/runtest/cve
> +++ b/runtest/cve
> @@ -101,3 +101,4 @@ cve-2026-43494 io_uring04
>   cve-2026-46300 xfrm02
>   cve-2026-46300-skb-segment xfrm03
>   cve-2026-46331 cve-2026-46331
> +cve-2026-64600 refluxfs

Please move this test before perf_event_open03. No new tests should be 
added below the memory leak comment unless those tests also cause memory 
leaks.

-- 
Martin Doucha   mdoucha@suse.cz
SW Quality Engineer
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3] cve: reproducer for cve-2026-64600

[Andrea Cervesato via ltp]

Hi Martin,

> Hi,
> I've test tested this reproducer on affected kernel v6.4 both with and 
> without the pressure threads. The version with pressure threads 
> commented out was actually 3 times faster in reproducing the race. I 
> recommend removing the pressure threads entirely.

It seems correct, I will remove it.

> Please move this test before perf_event_open03. No new tests should be 
> added below the memory leak comment unless those tests also cause memory 
> leaks.

+1

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] cve: reproducer for cve-2026-64600

[linuxtestproject.agent]

Hi Andrea,

On July 31, 2026, Andrea Cervesato wrote:
> cve: reproducer for cve-2026-64600

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp