CVE-2018-18690: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days.

In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only
• Linux Linux Kernel: before 4.17 (fixed in 4.17)

Published 2018-10-26. Last modified 2026-06-17.