CVE-2026-98445

Received Received - Intake

XFS Filesystem Memory Allocation Failure in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking blocks that were previously allocated to write a new btree, but the problem is worse than that -- a limitation of the codebase is that the callers cannot undo the transaction /and/ return the error -- either you undo all changes and commit the transaction, or you error out and the filesystem goes down. However, the new btree space reservation object isn't that big (~48 bytes). Let's just do a NOFAIL allocation and the problem goes away.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98445

EUVD

EUVD-2026-103685

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	be408417630427984a1fddd069f30b245793234c
Linux	Linux	be408417630427984a1fddd069f30b245793234c
Linux	Linux	be408417630427984a1fddd069f30b245793234c
Linux	Linux	be408417630427984a1fddd069f30b245793234c
Linux	Linux	6.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves memory allocation failures during XFS filesystem repairs. When a memory allocation fails during an online repair operation, it can cause the repair process to leak previously allocated blocks. The issue stems from the inability to undo transactions and return errors without crashing the filesystem. The proposed fix is to use a NOFAIL allocation for a small memory reservation (~48 bytes) to prevent the problem.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem and does not have network-based detection methods. To detect it, monitor kernel logs for XFS-related errors or filesystem corruption events. Check for memory allocation failures in XFS operations using dmesg or journalctl commands.

Impact Analysis

This vulnerability could lead to filesystem corruption or crashes during XFS repair operations if memory allocation fails. Users relying on XFS for storage may experience data loss or system instability when attempting repairs under low memory conditions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a filesystem-level issue in the Linux kernel related to memory allocation failures during XFS online repair operations, which could lead to filesystem corruption or downtime but does not involve data privacy or security controls typically governed by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching is not possible, avoid using XFS filesystem features that trigger online repairs until the patch is applied. Monitor system stability and filesystem health closely.

Hi! I’m here to help you understand CVE-2026-98445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70