CVE-2026-64356
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfs_dqinode_metadir_create() If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is left behind. Fix this memory leak by routing the create failure path through xfs_metadir_cancel(). For both create and commit failures, finish and release any inode returned to the caller, mirroring the unwind pattern in xfs_metadir_mkdir(). The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1. An x86_64 allyesconfig build showed no new warnings. Runtime validation used kprobe fault injection during `mount -o uquota` on a metadir XFS image. Injecting xfs_metadir_create() reproduced the old active-update path that left mount stuck later in mount setup; after this change, the same injection reported cancel_hits=1 and irele_hits=1. Injecting xfs_metadir_commit() exercised the old inode-reference leak path; after this change, it reported irele_hits=1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64356
EUVD
EUVD-2026-48900

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel xfs From 6.13-rc1 (inc) to 7.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Linux kernel's XFS file system. When xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the code returns immediately without properly cleaning up allocated resources, leading to memory leaks. The fix ensures proper cleanup by routing failure paths through xfs_metadir_cancel() to release inode references and transaction states.

Detection Guidance

This vulnerability is specific to the Linux kernel's XFS filesystem and involves a memory leak during metadir creation. Detection requires kernel-level inspection rather than network scanning. Check for XFS-related errors in system logs using commands like dmesg | grep xfs or journalctl -k | grep xfs. Monitor memory usage for leaks during XFS operations, particularly when mounting filesystems with metadir features.

Impact Analysis

This vulnerability can cause memory leaks during XFS file system operations, potentially leading to system resource exhaustion. It may cause system instability, crashes, or degraded performance due to unreleased memory and inode references. Users relying on XFS file systems could experience mount failures or unexpected system behavior.

Mitigation Strategies

Apply the kernel patch that fixes the memory leak in xfs_dqinode_metadir_create(). Update to a kernel version that includes this fix. If patching is not immediately possible, avoid using XFS metadir features or mount options that trigger this code path until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart