CVE-2026-98443 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix cursor and pointer handling when recovering iunlink buckets
LOLLM pointed out a bug in xlog_recover_iunlink_bucket:
1. We don't null out prev_ip after releasing it, which can lead to UAF problems if the inodegc flush call in the loop fails.
at which point I noticed even more bugs:
2. If the inodegc flush inside the loop fails, we also leak @ip.
3. We set prev_agino to agino having already advanced agino, which results in inodes with i_prev_unlinked set to itself.
4. If we exit the bottom of the loop with prev_ip set, then prev_ip aliases ip and we also set its i_prev_unlinked to itself.
Bugs 3 and 4 introduce loops into the unlinked list, though these loops don't surface because we immediately flush each unlinked inode after loading it.
Fix all of these issues.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel's XFS filesystem implementation contained a critical logic error within the xlog_recover_iunlink_bucket function during journal recovery operations. This vulnerability stems from improper handling of cursor and pointer states when processing iunlink buckets, which are data structures used to track inodes that have been unlinked but not yet fully removed from the directory structure. The root cause involves several interrelated flaws in memory management and state tracking within the loop that processes these unlinked inodes. Specifically, after releasing a reference to an inode via prev_ip, the pointer was not nullified, leaving it dangling if subsequent operations failed or altered control flow. This oversight creates conditions where stale pointers could be dereferenced later in the execution path, leading to use-after-free vulnerabilities. Such memory corruption issues are particularly dangerous as they can lead to kernel panics, data integrity loss, or potentially arbitrary code execution depending on how an attacker might manipulate the state of these structures during recovery phases.
Beyond the immediate risk of use-after-free errors, the flawed logic introduced significant resource management failures and structural inconsistencies within the filesystem metadata. If the inodegc flush operation inside the processing loop failed for any reason, the current inode pointer ip was not properly released, resulting in a memory leak that could degrade system performance over time or exhaust available kernel memory under heavy load conditions. Furthermore, the sequence of operations regarding the assignment of prev_agino occurred after agino had already been advanced, causing incorrect linkage data to be written back into the inode structures. This error resulted in i_prev_unlinked fields being set to point at themselves rather than their actual previous unlinked predecessor. These logical errors effectively introduced cycles or loops into what should have been a linear singly-linked list of unlinked inodes. While these circular references did not immediately surface as visible corruption because each unlinked inode was flushed and processed individually, the underlying structural integrity of the filesystem metadata was compromised, posing long-term risks for future recovery operations or consistency checks that rely on accurate traversal of this linked structure.
The operational impact of these vulnerabilities is primarily centered around system stability during crash recovery scenarios. Since xlog_recover_iunlink_bucket operates during journal replay after an unclean shutdown, any failure in processing can lead to incomplete recovery states where the filesystem remains inconsistent. The potential for use-after-free bugs means that under specific timing conditions or error paths triggered by hardware faults or extreme load, the kernel could crash with a general protection fault or page fault. Additionally, memory leaks contribute to gradual resource exhaustion, which may cause denial of service in long-running systems experiencing frequent unmounts and remounts or repeated crashes requiring journal replay. The introduction of loops into the unlinked list structure threatens data integrity by confusing filesystem consistency tools like xfs_repair, potentially leading to further corruption if not detected and corrected early.
Mitigation strategies involve applying the upstream kernel patches that correct these pointer handling and state management issues. Administrators should ensure their systems are updated with a Linux kernel version containing fixes for this specific XFS journal recovery logic. For environments where immediate patching is not feasible, monitoring system logs for I/O errors or filesystem consistency warnings during reboot sequences can help detect early signs of corruption related to unlinked inode processing. Regular execution of xfs_repair on non-mounted filesystems serves as a preventive measure to identify and fix any structural anomalies in the unlinked list before they escalate into more severe data integrity issues. From a security perspective, this vulnerability highlights the importance of rigorous code review for kernel-level memory management practices, particularly in complex subsystems like XFS where pointer arithmetic and reference counting are critical to maintaining system stability.
This issue aligns with CWE-416 Use After Free, as the failure to nullify pointers after release creates opportunities for dereferencing freed memory. It also relates to CWE-772 Missing Release of Resource after Effective Lifetime, due to the leaked inode references when flush operations fail. The structural corruption of linked lists falls under CWE-835 Loop with Unreachable Exit Condition or similar logic errors affecting data structure integrity. In terms of ATT&CK mapping, while this is not directly exploitable by an external attacker without prior access and specific conditions, it represents a weakness in the operating system's core functionality that could be leveraged for privilege escalation if combined with other vulnerabilities to trigger kernel crashes during recovery processes. The fix ensures proper nullification of pointers after release, correct sequencing of variable assignments to prevent self-referential links, and robust error handling to prevent resource leaks, thereby restoring the integrity and reliability of XFS journal recovery mechanisms.