CVE-2026-64356 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix memory leak in xfs_dqinode_metadir_create()
If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is left behind.
Fix this memory leak by routing the create failure path through xfs_metadir_cancel(). For both create and commit failures, finish and release any inode returned to the caller, mirroring the unwind pattern in xfs_metadir_mkdir().
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. Runtime validation used kprobe fault injection during `mount -o uquota` on a metadir XFS image. Injecting xfs_metadir_create() reproduced the old active-update path that left mount stuck later in mount setup; after this change, the same injection reported cancel_hits=1 and irele_hits=1. Injecting xfs_metadir_commit() exercised the old inode-reference leak path; after this change, it reported irele_hits=1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability identified in the Linux kernel's XFS filesystem implementation represents a critical memory management flaw that manifests as a persistent memory leak within the quota inode directory creation mechanism. This issue specifically affects the xfs_dqinode_metadir_create() function where improper error handling leads to resource exhaustion and potential system instability. The flaw occurs when xfs_metadir_create() fails during the quota inode directory creation process, causing the code to return directly without properly cleaning up allocated update structures and transaction state information. This memory leak represents a direct violation of proper resource management principles and creates conditions where kernel memory becomes progressively consumed during filesystem operations.
The technical implementation of this vulnerability stems from inadequate error path handling within the XFS quota subsystem, where the function fails to follow established cleanup protocols when encountering failures during directory creation. The flaw specifically impacts the transaction state management and update structure allocation processes that occur during quota inode directory setup operations. When xfs_metadir_create() encounters an error condition, the existing code path bypasses proper cleanup routines, leaving allocated memory structures in an inconsistent state while simultaneously failing to release caller-owned inode references that should be properly managed. This represents a classic case of resource leak vulnerability where multiple allocation points are not properly matched with corresponding deallocation routines, creating a persistent memory consumption issue.
The operational impact of this vulnerability extends beyond simple memory consumption to potentially affect system stability and performance during high-volume filesystem operations involving quota management. The memory leak can accumulate over time, particularly in environments with frequent mount operations or heavy quota usage patterns, leading to gradual degradation of system performance and potential out-of-memory conditions. During normal operation, this vulnerability may not manifest immediately but becomes increasingly problematic as the system continues to process quota-related operations. The issue is particularly concerning in production environments where XFS filesystems are actively used with quota enforcement enabled, as it can lead to unexpected system resource exhaustion and operational instability.
The fix implemented addresses this vulnerability by introducing proper error path routing through the xfs_metadir_cancel() function, ensuring that all allocated resources are properly cleaned up regardless of whether creation or commit operations fail. This solution mirrors the established unwind patterns found in xfs_metadir_mkdir(), providing consistency with existing codebase practices and maintaining proper resource management protocols. The implementation ensures that both create failures and commit failures follow identical cleanup routines that properly finish and release any inode references returned to callers, preventing the accumulation of leaked memory structures. This approach aligns with established kernel development practices for managing transactional resources and provides a robust solution that maintains system stability while preserving existing functionality.
The vulnerability was initially detected through advanced static analysis techniques using an experimental kernel memory management analysis tool, demonstrating the effectiveness of automated analysis in identifying subtle resource management issues within complex kernel subsystems. This detection method represents a growing trend in kernel security analysis where specialized tools can identify edge cases and resource leak patterns that manual code review might miss. The vulnerability's presence in multiple kernel versions including v7.1.1 indicates that this issue has persisted for an extended period, highlighting the importance of continuous security analysis and the potential for long-standing memory management flaws in critical subsystems. The validation process using kprobe fault injection demonstrated the effectiveness of the fix by showing proper cleanup behavior through cancel_hits and irele_hits counters, confirming that the memory leak has been resolved.
This vulnerability classification aligns with CWE-401 Memory Leak and relates to ATT&CK technique T1490 Inhibit System Recovery by demonstrating how improper resource management can lead to system instability. The fix maintains compatibility with existing kernel configurations as shown by the allyesconfig build results, indicating no regression in functionality while resolving the memory leak issue. The solution's implementation follows established kernel development patterns and provides a robust mechanism for handling error conditions in transactional filesystem operations, ensuring that quota-related filesystem management remains stable and efficient under various operational conditions.