---
id: CVE-2026-99080
title: 'fs: Free any excess xarray nodes in clear_inode()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs: Free any excess xarray nodes in clear_inode()

  For many years we've had a hard to hit leak of xarray nodes.  Hugh
  documented it well in commit 786b31121a2c.  Recent…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f1c966eb6ed5e190c90a56c5bdaa69967de39f21
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    21f51434c47d8628b62275ae6c6ad6b573abcd02
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    50cff3f112d64db6e5f57355f79bc837db8fe132
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    43f830e2bb84b22ca824b20bb861d823ecb520bd
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    ee3f011250104129893d8e9599147e457d4d7280
  - Linux < 6.6.160
  - Linux < 6.12.113
  - Linux < 6.18.57
  - Linux < 7.2.11
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:23:27.393Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99080'
references:
  - url: 'https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21'
  - url: 'https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02'
  - url: 'https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132'
  - url: 'https://git.kernel.org/stable/c/43f830e2bb84b22ca824b20bb861d823ecb520bd'
  - url: 'https://git.kernel.org/stable/c/ee3f011250104129893d8e9599147e457d4d7280'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.511Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fs: Free any excess xarray nodes in clear_inode()

For many years we've had a hard to hit leak of xarray nodes.  Hugh
documented it well in commit 786b31121a2c.  Recently people and
syzbot have found ways to force it to happen with madvise.  Rather
than fix the leaks where they happen, just call xa_destroy() which
has the side-effect of cycling the i_pages lock.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f1c966eb6ed5e190c90a56c5bdaa69967de39f21`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 21f51434c47d8628b62275ae6c6ad6b573abcd02`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 50cff3f112d64db6e5f57355f79bc837db8fe132`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 43f830e2bb84b22ca824b20bb861d823ecb520bd`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ee3f011250104129893d8e9599147e457d4d7280`
- `Linux < 6.6.160`
- `Linux < 6.12.113`
- `Linux < 6.18.57`
- `Linux < 7.2.11`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.