Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-64600 — kernel: XFS data corruption using reflink
🎯 Affected products7
- Red Hat Enterprise Linux BaseOS (v. 10)
- kpatch-patch-6_12_0-211_16_1-0:1-5.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
- kpatch-patch-6_12_0-211_16_1-0:1-5.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
- kpatch-patch-6_12_0-211_16_1-0:1-5.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
- kpatch-patch-6_12_0-211_16_1-debuginfo-0:1-5.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
- kpatch-patch-6_12_0-211_16_1-debuginfo-0:1-5.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
- kpatch-patch-6_12_0-211_16_1-debugsource-0:1-5.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below: 1. Install and configure SystemTap Install the SystemTap package and its dependencies following the instructions at: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap 2. Create the mitigation script Create a file named `refluxfs_mitigation.stp` with the following contents: ~~~ probe begin { printf("refluxfs mitigation loaded\n") } probe module("xfs").function("xfs_file_remap_range").call { $remap_flags = 0xffff } probe module("xfs").function("xfs_file_remap_range").return { $return = -95 } probe end { printf("refluxfs mitigation unloaded\n") } ~~~ 3. Load the mitigation As the `root` user, execute SystemTap in guru mode: ~~~ stap -g refluxfs_mitigation.stp ~~~ Once the script is compiled and loaded, the following message will appear: ~~~ refluxfs mitigation loaded ~~~ With the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall. Important considerations: 1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the "Sign a SystemTap module" section of: https://www.redhat.com/en/blog/secure-boot-systemtap 2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied. 3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux.