CVE-2026-46005: Linux Kernel Resource Leak Vulnerability

CVE-2026-46005 Overview

CVE-2026-46005 is a resource leak vulnerability in the Linux kernel XFS filesystem. The flaw resides in xfs_alloc_buftarg(), where the error path fails to release a Direct Access (DAX) device reference. When allocation fails after acquiring the DAX device, the kernel does not invoke fs_put_dax() to decrement the reference count.

The upstream fix calls fs_put_dax() in the error path to properly release the DAX device reference. Multiple stable kernel branches received corresponding backports.

Critical Impact
Repeated failures during XFS buffer target allocation leak DAX device references, potentially causing resource exhaustion and preventing clean module unload or device teardown over time.

Affected Products

Linux kernel — XFS filesystem subsystem
Multiple stable kernel branches receiving backported patches
Systems using DAX-enabled storage with XFS

Discovery Timeline

2026-05-27 - CVE-2026-46005 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46005

Vulnerability Analysis

The vulnerability is a memory and reference leak [CWE-401] in the XFS buffer target allocation routine. The function xfs_alloc_buftarg() acquires a DAX device reference during initialization. If a subsequent step in the allocation sequence fails, the function returns an error without releasing the DAX device reference obtained earlier.

DAX devices use reference counting to track active users. Each successful acquisition must be paired with a matching fs_put_dax() call. The missing release in the error path means the reference count grows monotonically across failed allocations.

The consequence is a slow resource leak. Over time, repeated allocation failures prevent the DAX device from reaching a zero reference count, blocking clean teardown of the device and potentially the underlying block device.

Root Cause

The root cause is incomplete error handling in xfs_alloc_buftarg(). The function follows a multi-step initialization pattern but the cleanup path omits the fs_put_dax() call required to balance the earlier DAX device acquisition. This is a common class of bug in kernel resource management where cleanup paths drift out of sync with acquisition paths as code evolves.

Attack Vector

This is not a directly exploitable code execution flaw. Triggering the leak requires conditions that cause xfs_alloc_buftarg() to enter its error path, such as memory pressure or device initialization failures during XFS mount operations on DAX-backed storage. The impact is reliability and resource exhaustion rather than privilege escalation or arbitrary code execution.

The vulnerability is described in prose only. See the upstream commits for the exact patch:

Detection Methods for CVE-2026-46005

Indicators of Compromise

Persistent DAX device references that prevent device or module teardown
Failed XFS mount attempts on DAX-enabled storage followed by inability to release the underlying device
Kernel log entries from XFS during mount failures involving buffer target allocation

Detection Strategies

Inventory hosts running kernel versions predating the linked stable commits and identify those configured with DAX-backed storage
Compare running kernel versions against the fixed builds shipped in each stable branch backport
Track unexpected growth in DAX device reference counts following XFS mount failures

Monitoring Recommendations

Monitor dmesg and journalctl for repeated XFS mount failures referencing buffer target allocation
Alert on hosts where DAX devices cannot be detached or where filesystem teardown stalls
Track kernel version drift across the fleet to identify systems missing the backported fix

How to Mitigate CVE-2026-46005

Immediate Actions Required

Apply the stable kernel update that includes the fs_put_dax() call in the xfs_alloc_buftarg() error path
Identify systems using XFS on DAX-enabled persistent memory and prioritize them for patching
Reboot patched hosts to load the corrected kernel

Patch Information

The fix adds an fs_put_dax() call in the error path of xfs_alloc_buftarg() to release the DAX device reference. The change has been merged upstream and backported to multiple stable branches. Reference the linked kernel.org commits to confirm which stable branch corresponds to your distribution kernel and verify your vendor has integrated the patch.

Workarounds

Avoid mount conditions that exercise the error path, such as low-memory states during XFS mount on DAX devices
Where DAX is not required, mount XFS without the dax option to bypass the affected code path
Reboot affected systems if DAX device reference leaks accumulate to a point that blocks teardown

bash

# Verify running kernel version against fixed stable builds
uname -r

# Check which filesystems are mounted with DAX
mount | grep -i dax

# Inspect kernel log for XFS mount errors
dmesg | grep -i xfs