CVE-2026-64146: Linux Kernel Information Disclosure Flaw

CVE-2026-64146 Overview

CVE-2026-64146 is a memory leak vulnerability in the Linux kernel's erofs (Enhanced Read-Only File System) driver. The flaw resides in erofs_init_inode_xattrs(), which handles inline extended attribute (xattr) header parsing and shared xattr identifier arrays. Several error paths after erofs_read_metabuf() exit through the out_unlock label without releasing the metabuf, causing the underlying folio reference to leak. Repeated triggering of these error paths on erofs inodes can exhaust folio references and degrade system stability. The upstream fix consolidates cleanup at out_unlock and relies on erofs_put_metabuf() being a no-op when no folio has been acquired.

Critical Impact
Error paths in erofs xattr initialization leak folio references, enabling resource exhaustion against systems mounting erofs images with malformed or crafted xattr metadata.

Affected Products

Linux kernel versions containing commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") prior to the fix
Distributions shipping vulnerable stable Linux kernel branches
Systems that mount erofs filesystem images

Discovery Timeline

2026-07-19 - CVE-2026-64146 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64146

Vulnerability Analysis

The erofs driver uses on-stack erofs_buf instances for metadata reads following commit bb88e8da0025. In erofs_init_inode_xattrs(), the driver calls erofs_read_metabuf() to map the inline xattr header and shared xattr identifier array from the backing image. Successful reads acquire a folio reference stored inside the buffer descriptor.

After setting the EROFS_I_BL_XATTR_BIT bit lock, several validation checks can fail — including malformed header fields and unexpected shared identifier counts. These paths jump to out_unlock and release the bit lock but never call erofs_put_metabuf(). The acquired folio reference remains held indefinitely, producing a resource leak on every failed initialization.

Repeated exposure of the same inode or many inodes with faulty xattr metadata compounds the leak. Because erofs is commonly deployed for read-only images such as Android system partitions and container base layers, an attacker able to supply a crafted image can force sustained leaks during xattr access.

Root Cause

The root cause is missing cleanup on error paths after a successful erofs_read_metabuf() call. Cleanup was scattered across success paths but omitted where jumps to out_unlock occurred, leaving the folio reference count elevated. This is a classic Memory Leak pattern in kernel code where acquired resources are not centralized to a single release site.

Attack Vector

Exploitation requires the ability to mount or access an erofs image with malformed xattr metadata. A local user or automated mount workflow that processes attacker-supplied erofs images can repeatedly invoke the vulnerable initialization path. The impact is resource exhaustion rather than code execution or privilege escalation. See the kernel commit record for the exact code change.

No public exploit or proof-of-concept is available at the time of publication.

Detection Methods for CVE-2026-64146

Indicators of Compromise

Unexpected growth in kernel folio and page cache reference counts on hosts mounting erofs images
Repeated erofs xattr initialization failures logged via dmesg or journalctl
Mount events referencing untrusted or user-supplied erofs image files

Detection Strategies

Audit running kernel versions across the fleet and compare against the fixed stable commits 492c73b21fefa36f3869cb2b188ffb7fe37b3a9b and 79b09c54c6563df9846ca3094bcfd72082c3e1d7
Monitor kernel log streams for erofs xattr-related error messages coinciding with memory pressure
Track filesystem mount telemetry to identify hosts consuming untrusted erofs images

Monitoring Recommendations

Alert on sustained increases in /proc/meminfo folio and slab counters on erofs-heavy workloads
Instrument container and Android build systems to log erofs mount sources and integrity checks
Correlate kernel warning messages from the erofs subsystem with process activity performing xattr reads

How to Mitigate CVE-2026-64146

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 492c73b21fefa36f3869cb2b188ffb7fe37b3a9b and 79b09c54c6563df9846ca3094bcfd72082c3e1d7
Restrict mounting of erofs images to trusted sources and administrative users only
Validate integrity of erofs images used in container, Android, and appliance workflows before mount

Patch Information

The fix consolidates all post-erofs_read_metabuf() cleanup at the out_unlock label so erofs_put_metabuf() is called on every exit path after EROFS_I_BL_XATTR_BIT is taken. Because erofs_put_metabuf() is a no-op when no folio was acquired, the consolidated cleanup is safe for all paths. Distribution kernel updates carrying the referenced stable commits resolve the issue. See the kernel git commit record for the applied change.

Workarounds

Disable or block automated mounting of untrusted erofs images until patched kernels are deployed
Reboot long-running hosts after leak accumulation to reclaim leaked folio references as a temporary measure
Enforce image signing and verification pipelines for erofs artifacts consumed by production systems

bash

# Verify running kernel version and installed erofs-related patches
uname -r
grep -r "erofs_init_inode_xattrs" /lib/modules/$(uname -r)/ 2>/dev/null

# Restrict erofs mounts to root only via mount policy
# (example: block user mounts of erofs images in /etc/fstab and udev rules)