CVE-2026-64146 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix metabuf leak in inode xattr initialization
commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array.
Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak.
Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel represents a memory management issue within the erofs filesystem implementation that could lead to resource exhaustion and potential system instability. This flaw specifically affects the extended attributes handling mechanism during inode initialization, where improper cleanup of metadata buffers creates a subtle but significant leak condition. The vulnerability stems from changes introduced in commit bb88e8da0025 which restructured xattr operations to utilize on-stack erofs_buf instances for improved performance and memory efficiency. However, this refactoring introduced a critical oversight in error path handling that was not adequately addressed during the implementation phase.
The technical flaw manifests when erofs_init_inode_xattrs() function processes inline extended attribute headers and shared xattr id arrays using metabuf instances acquired through erofs_read_metabuf(). Under normal operating conditions, these metadata buffers are properly managed and released. However, certain error conditions that occur after the initial buffer acquisition can bypass the standard cleanup mechanism, specifically when execution flows through the out_unlock label without properly releasing the folio reference associated with the metabuf. This creates a situation where memory allocated for metadata buffers remains allocated even though the operation has failed or completed unexpectedly.
The operational impact of this vulnerability extends beyond simple memory leak characteristics to potentially affect system stability and performance over time. When multiple error conditions occur during extended attribute processing, each instance contributes to accumulating unreleased memory resources that can gradually consume available system memory. This type of resource leak is particularly concerning in environments where filesystem operations are frequent or under heavy load, as the cumulative effect can eventually lead to memory pressure that impacts overall system performance. The vulnerability affects all systems running affected kernel versions and can be triggered through normal filesystem operations involving extended attributes.
The root cause analysis reveals a classic control flow issue where error handling paths do not consistently execute cleanup routines, creating an inconsistent state management pattern within the filesystem driver. This type of vulnerability aligns with CWE-404, which addresses improper resource release or unbalanced allocation and deallocation, and demonstrates how seemingly benign refactoring can introduce subtle but serious memory management defects. The fix implemented consolidates all cleanup operations at a single location through the out_unlock label, ensuring that erofs_put_metabuf() is called consistently regardless of execution path taken after buffer acquisition. This approach follows the principle of defensive programming by ensuring that all resource acquisitions have corresponding releases, even in error conditions.
Mitigation strategies for this vulnerability require immediate kernel updates to patched versions containing the consolidated cleanup mechanism. System administrators should prioritize patching affected systems, particularly those running erofs filesystems under high load or in environments where memory efficiency is critical. The fix demonstrates a best practice pattern of centralized resource management that aligns with ATT&CK framework concepts related to system resource hijacking and memory corruption techniques that attackers might exploit if left unpatched. Organizations should also implement monitoring for unusual memory consumption patterns that could indicate the presence of such leaks in systems where patching timelines may be extended due to operational constraints or testing requirements.