---
id: CVE-2026-64146
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  erofs: fix metabuf leak in inode xattr initialization

  commit bb88e8da0025 ("erofs: use meta buffers for xattr operations")
  converted xattr operations to use on-stack e…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  erofs: fix metabuf leak in inode xattr initialization

  commit bb88e8da0025 ("erofs: use meta buffers for xattr operations")
  converted xattr operations to use on-stack e…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.17, < 7.0.11'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.11
published: '2026-07-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:39.427'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64146'
references:
  - url: 'https://git.kernel.org/stable/c/492c73b21fefa36f3869cb2b188ffb7fe37b3a9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/79b09c54c6563df9846ca3094bcfd72082c3e1d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fcb23bb31508b62e8a1b32adf6217820e90e29b0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00112
epssPercentile: 0.01295
ingestedAt: '2026-10-15T11:00:41.697Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix metabuf leak in inode xattr initialization

commit bb88e8da0025 ("erofs: use meta buffers for xattr operations")
converted xattr operations to use on-stack erofs_buf instances.
erofs_init_inode_xattrs() uses such a metabuf while reading the inline
xattr header and shared xattr id array.

Some error paths after erofs_read_metabuf() leave through out_unlock
without dropping the metabuf, so the folio reference can leak.

Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a
no-op if no folio has been acquired, and this keeps all paths after
taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.

## Affected

- `linux_kernel >= 5.17, < 7.0.11`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.11`