CVE-2026-64356: xfs: fix memory leak in xfs_dqinode_metadir_create()
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix memory leak in xfsdqinodemetadircreate()
If xfsmetadircreate() fails in xfsdqinodemetadircreate(), the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is left behind.
Fix this memory leak by routing the create failure path through xfsmetadircancel(). For both create and commit failures, finish and release any inode returned to the caller, mirroring the unwind pattern in xfsmetadirmkdir().
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.
An x8664 allyesconfig build showed no new warnings. Runtime validation used kprobe fault injection during mount -o uquota on a metadir XFS image. Injecting xfsmetadircreate() reproduced the old active-update path that left mount stuck later in mount setup; after this change, the same injection reported cancelhits=1 and irelehits=1. Injecting xfsmetadircommit() exercised the old inode-reference leak path; after this change, it reported irelehits=1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (XFS)to a version that resolves this vulnerability.Fixed in v6.13-rc1 - Configuration
When using `mount -o uquota` on an XFS metadir, ensure the kernel includes the fix for the memory leak in `xfs_dqinode_metadir_create()` (reported as resolved in v6.13-rc1), since kprobe fault injection on this path reproduced the leak.
XFS uquota mount option = only as needed
Event History
Frequently Asked Questions
Which systems are known to be affected?
Manual inspection confirmed that the bug is present in Linux kernel v7.1.1. The reported runtime scenario involved mounting an XFS metadir image with the uquota mount option.
What conditions are needed to trigger the issue?
The problematic paths are triggered when xfs_metadir_create() fails or when the subsequent commit fails during xfs_dqinode_metadir_create(). Validation reproduced the issue using kprobe fault injection of xfs_metadir_create().
What impact was observed during testing?
Under injected xfs_metadir_create() failure, the old code left an active update path that caused the mount to become stuck later in mount setup. The corrected path cancelled the update and released the inode reference.