---
id: CVE-2026-98443
title: 'xfs: fix cursor and pointer handling when recovering iunlink buckets'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: fix cursor and pointer handling when recovering iunlink buckets

  LOLLM pointed out a bug in xlog_recover_iunlink_bucket:

  1. We don't null out prev_ip after releas…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 <
    8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1
  - >-
    Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 <
    66a2179d02668f8df44b1a249899006f3ba38ea0
  - >-
    Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 <
    961c717e6bf0e53c2c2b1fe4aef1add9390fedab
  - >-
    Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 <
    65f39d09d73718611cee40399179323b5d4ead00
  - Linux 6.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:14:53.597Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98443'
references:
  - url: 'https://git.kernel.org/stable/c/8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1'
  - url: 'https://git.kernel.org/stable/c/66a2179d02668f8df44b1a249899006f3ba38ea0'
  - url: 'https://git.kernel.org/stable/c/961c717e6bf0e53c2c2b1fe4aef1add9390fedab'
  - url: 'https://git.kernel.org/stable/c/65f39d09d73718611cee40399179323b5d4ead00'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.306Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix cursor and pointer handling when recovering iunlink buckets

LOLLM pointed out a bug in xlog_recover_iunlink_bucket:

1. We don't null out prev_ip after releasing it, which can lead to UAF
   problems if the inodegc flush call in the loop fails.

at which point I noticed even more bugs:

2. If the inodegc flush inside the loop fails, we also leak @ip.

3. We set prev_agino to agino having already advanced agino, which
   results in inodes with i_prev_unlinked set to itself.

4. If we exit the bottom of the loop with prev_ip set, then prev_ip
   aliases ip and we also set its i_prev_unlinked to itself.

Bugs 3 and 4 introduce loops into the unlinked list, though these loops
don't surface because we immediately flush each unlinked inode after
loading it.

Fix all of these issues.

## Affected

- `Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 < 8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1`
- `Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 < 66a2179d02668f8df44b1a249899006f3ba38ea0`
- `Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 < 961c717e6bf0e53c2c2b1fe4aef1add9390fedab`
- `Linux >= 04755d2e5821b3afbaadd09fe5df58d04de36484 < 65f39d09d73718611cee40399179323b5d4ead00`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.