CVE-2026-64146
Received Received - Intake

Memory Leak in EROFS Linux Kernel Filesystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array. Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak. Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64146
EUVD
EUVD-2026-45831

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel erofs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the erofs filesystem. When initializing inode extended attributes (xattrs), a buffer called metabuf is used. Some error paths fail to properly release this buffer, causing a reference to a folio (memory page) to leak. The fix consolidates cleanup in a single location to prevent this issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's erofs filesystem and requires kernel-level inspection. Detection involves checking kernel logs for erofs-related errors or verifying if your kernel version includes the vulnerable commit bb88e8da0025. Use commands like 'uname -a' to check kernel version and 'dmesg | grep erofs' to look for filesystem errors.

Impact Analysis

The impact is primarily on system stability and resource usage. A leaked folio reference could lead to gradual memory exhaustion, causing performance degradation or crashes over time. However, it requires specific conditions to trigger and does not directly expose data or allow privilege escalation.

Compliance Impact

This vulnerability involves a memory leak in the Linux kernel's EROFS filesystem due to improper handling of metadata buffers during inode xattr operations. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. However, unpatched systems could experience resource exhaustion, potentially leading to denial-of-service conditions that might indirectly affect compliance by disrupting data processing or access.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. Monitor vendor advisories for kernel updates and apply patches promptly. If immediate patching is not possible, consider disabling erofs filesystem usage as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart