CVE-2026-64356: xfs: fix memory leak in xfs_dqinode_metadir_create()

Published Jul 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix memory leak in xfsdqinodemetadircreate()

If xfsmetadircreate() fails in xfsdqinodemetadircreate(), the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is left behind.

Fix this memory leak by routing the create failure path through xfsmetadircancel(). For both create and commit failures, finish and release any inode returned to the caller, mirroring the unwind pattern in xfsmetadirmkdir().

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.

An x8664 allyesconfig build showed no new warnings. Runtime validation used kprobe fault injection during mount -o uquota on a metadir XFS image. Injecting xfsmetadircreate() reproduced the old active-update path that left mount stuck later in mount setup; after this change, the same injection reported cancelhits=1 and irelehits=1. Injecting xfsmetadircommit() exercised the old inode-reference leak path; after this change, it reported irelehits=1.

Affected Software

4 affected components
Linux Linux kernel>6.13-rc1<=7.1.1
Linux Linux kernel>=6.13<6.18.39
Linux Linux kernel>=6.19<7.1.4
Linux Linux kernel=7.2-rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Linux kernel (XFS) to a version that resolves this vulnerability.

    Fixed in v6.13-rc1
  2. Configuration

    When using `mount -o uquota` on an XFS metadir, ensure the kernel includes the fix for the memory leak in `xfs_dqinode_metadir_create()` (reported as resolved in v6.13-rc1), since kprobe fault injection on this path reproduced the leak.

    XFS uquota mount option = only as needed

Event History

Jul 25, 2026
CVE Published
via MITRE·08:50 AM
Data Sourced
via MITRE·08:50 AM
Description
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which systems are known to be affected?

Manual inspection confirmed that the bug is present in Linux kernel v7.1.1. The reported runtime scenario involved mounting an XFS metadir image with the uquota mount option.

2

What conditions are needed to trigger the issue?

The problematic paths are triggered when xfs_metadir_create() fails or when the subsequent commit fails during xfs_dqinode_metadir_create(). Validation reproduced the issue using kprobe fault injection of xfs_metadir_create().

3

What impact was observed during testing?

Under injected xfs_metadir_create() failure, the old code left an active update path that caused the mount to become stuck later in mount setup. The corrected path cancelled the update and released the inode reference.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203