Description
The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.16.2-1 | — |
| Debian 13 | linux | 3.16.2-1 | — |
| Debian 12 | linux | 3.16.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-27.50 | USN-2226-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | kernel-rt +10 | 3.10.58-rt62.58.el6rt | RHSA-2014:1943 |
Advisories 2
- USN-2226-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- RHSA-2014:1943 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 70261 vdb-entry
- https://github.com/torvalds/linux/commit/c88547a8119e3b581318ab65e9b72f27f23e641d
- [xfs] 20140327 xfs errors while unlinking filenames with hash collisions mailing-list
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.2
- [oss-security] 20141002 xfs directory hash ordering bug mailing-list
- RHSA-2014:1943 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c88547a8119e3b581318ab65e9b72f27f23e641d
- https://bugzilla.redhat.com/show_bug.cgi?id=1148777