{"id":"CVE-2026-64356","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix memory leak in xfs_dqinode_metadir_create()\n\nIf xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current\ncode returns directly, leaking the allo…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix memory leak in xfs_dqinode_metadir_create()\n\nIf xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current\ncode returns directly, leaking the allo…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-401","CWE-772"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.13, < 6.18.39","linux_kernel >= 6.19, < 7.1.4","linux_kernel = 7.2"],"patched":["linux_kernel 7.1.4"],"published":"2026-07-25","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64356","references":[{"url":"https://git.kernel.org/stable/c/06a2e6dbaa26c0740ac76dfa66b0aedc78d05820","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45de375b25060edf46e20abb36521ba530336ceb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64356.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64356"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507202"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64356"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64356"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072519-CVE-2026-64356-d9e2@gregkh/T"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00136,"epssPercentile":0.03421,"ingestedAt":"2026-09-05T13:39:56.715Z","slug":"CVE-2026-64356","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix memory leak in xfs_dqinode_metadir_create()\n\nIf xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current\ncode returns directly, leaking the allocated update and transaction state.\nIf the subsequent commit fails, the caller-owned inode reference is left\nbehind.\n\nFix this memory leak by routing the create failure path through\nxfs_metadir_cancel().  For both create and commit failures, finish and\nrelease any inode returned to the caller, mirroring the unwind pattern in\nxfs_metadir_mkdir().\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. Runtime validation\nused kprobe fault injection during `mount -o uquota` on a metadir XFS\nimage. Injecting xfs_metadir_create() reproduced the old active-update path\nthat left mount stuck later in mount setup; after this change, the same\ninjection reported cancel_hits=1 and irele_hits=1. Injecting\nxfs_metadir_commit() exercised the old inode-reference leak path; after\nthis change, it reported irele_hits=1.\n\n## Affected\n\n- `linux_kernel >= 6.13, < 6.18.39`\n- `linux_kernel >= 6.19, < 7.1.4`\n- `linux_kernel = 7.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.1.4`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64356.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}