CVE-2026-98443
Received Received - Intake

Memory Corruption in Linux Kernel XFS Filesystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releasing it, which can lead to UAF problems if the inodegc flush call in the loop fails. at which point I noticed even more bugs: 2. If the inodegc flush inside the loop fails, we also leak @ip. 3. We set prev_agino to agino having already advanced agino, which results in inodes with i_prev_unlinked set to itself. 4. If we exit the bottom of the loop with prev_ip set, then prev_ip aliases ip and we also set its i_prev_unlinked to itself. Bugs 3 and 4 introduce loops into the unlinked list, though these loops don't surface because we immediately flush each unlinked inode after loading it. Fix all of these issues.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98443
EUVD
EUVD-2026-103683

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 04755d2e5821b3afbaadd09fe5df58d04de36484
Linux Linux 04755d2e5821b3afbaadd09fe5df58d04de36484
Linux Linux 04755d2e5821b3afbaadd09fe5df58d04de36484
Linux Linux 04755d2e5821b3afbaadd09fe5df58d04de36484
Linux Linux 6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves bugs in the XFS file system's recovery of unlinked inode buckets. The issues include use-after-free (UAF) risks due to improper pointer handling, memory leaks when inode garbage collection fails, and circular references in unlinked lists that could corrupt file system operations.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or unauthorized access if exploited. It may allow attackers to manipulate file system operations, potentially causing denial-of-service conditions or privilege escalation on affected Linux systems.

Mitigation Strategies

Apply the latest Linux kernel patches that address this vulnerability. Monitor vendor advisories for updates specific to your distribution and update affected systems promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart