CVE-2026-64356: Linux Kernel Memory Leak Vulnerability

CVE-2026-64356 Overview

CVE-2026-64356 is a memory leak vulnerability in the Linux kernel's XFS filesystem, specifically in the xfs_dqinode_metadir_create() function. When xfs_metadir_create() fails, the original code returns directly without cleaning up allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is also leaked.

The flaw was identified through an experimental kernel memory-management analysis tool during review of Linux v6.13-rc1, and manual inspection confirmed the bug persisted through v7.1.1. The fix routes the create failure path through xfs_metadir_cancel() and properly releases any inode returned to the caller.

Critical Impact
Repeated failures in XFS quota metadata directory creation can exhaust kernel memory and leave inode references dangling, potentially stalling filesystem mount operations.

Affected Products

Linux kernel XFS filesystem subsystem
Kernel versions from v6.13-rc1 through v7.1.1 (confirmed by manual inspection)
Systems using XFS with user quota (uquota) and metadir features enabled

Discovery Timeline

2026-07-25 - CVE-2026-64356 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64356

Vulnerability Analysis

The vulnerability resides in xfs_dqinode_metadir_create(), a function responsible for creating quota inode entries within the XFS metadata directory. The function invokes xfs_metadir_create() to perform the underlying create operation and later commits the associated transaction.

When xfs_metadir_create() returns an error, the original implementation returns directly to the caller. This early return skips the cleanup of the allocated metadir update structure and the associated transaction state, producing a memory leak. A second leak occurs when the commit step fails: the caller-owned inode reference is not released.

Runtime validation using kprobe fault injection during mount -o uquota on a metadir XFS image reproduced both failure paths. The patched version reported cancel_hits=1 and irele_hits=1, confirming that both the transaction cancel and inode release cleanup paths now execute correctly.

Root Cause

The root cause is an incomplete error-handling unwind pattern. The function did not mirror the cleanup sequence used in the sibling xfs_metadir_mkdir() function. Two resource categories were leaked: the transaction/update state produced before the create call, and any inode reference produced when the create succeeded but the commit failed.

Attack Vector

The leak triggers along error paths in XFS metadir quota inode creation. An attacker or a faulty storage stack that induces repeated xfs_metadir_create() or xfs_metadir_commit() failures can gradually exhaust kernel memory and leave mount operations wedged. Exploitation requires local access with the ability to mount XFS filesystems or induce filesystem I/O errors. The vulnerability does not provide code execution or privilege escalation.

The fix, described in the upstream commits, routes the create failure through xfs_metadir_cancel() and finishes and releases any inode returned to the caller across both create and commit failure branches. See the kernel commit c3d3d221, kernel commit 06a2e6db, and kernel commit 45de375b for the code change.

Detection Methods for CVE-2026-64356

Indicators of Compromise

Mount operations for XFS filesystems with uquota enabled that hang or stall during setup.
Growing unaccounted kernel slab consumption on hosts that frequently create or repair XFS metadir quota inodes.
Repeated XFS transaction failure messages in dmesg originating from xfs_metadir_create or xfs_metadir_commit call sites.

Detection Strategies

Correlate kernel version and XFS mount options against the affected range (v6.13-rc1 through v7.1.1) using configuration management data.
Instrument kprobes on xfs_dqinode_metadir_create in test environments to observe error-path frequencies.
Track kernel memory growth trends on storage-heavy systems and alert on sustained slab expansion without matching workload changes.

Monitoring Recommendations

Ingest dmesg and kernel journal logs into centralized logging and search for XFS metadir error signatures.
Monitor slabtop and /proc/meminfo for anomalous kernel allocation patterns on XFS hosts.
Alert on mount timeouts and unusually long mount process durations on filesystems using XFS quotas.

How to Mitigate CVE-2026-64356

Immediate Actions Required

Inventory Linux hosts running kernel versions v6.13-rc1 through v7.1.1 with XFS filesystems mounted using quota options.
Schedule kernel upgrades to a version containing the fix commits c3d3d221, 06a2e6db, or 45de375b.
Restrict local user ability to mount arbitrary XFS images on multi-tenant systems until the patch is applied.

Patch Information

The fix is available in the upstream Linux kernel via commits c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1, 06a2e6dbaa26c0740ac76dfa66b0aedc78d05820, and 45de375b25060edf46e20abb36521ba530336ceb. Apply distribution kernel updates that incorporate these commits. Verify the update by inspecting the XFS source for the xfs_metadir_cancel() invocation in the failure path of xfs_dqinode_metadir_create().

Workarounds

Avoid mounting XFS filesystems with the uquota, gquota, or pquota options on affected kernels where feasible.
Ensure underlying storage is healthy to reduce the likelihood of triggering xfs_metadir_create() or xfs_metadir_commit() failures.
Reboot affected hosts periodically to reclaim leaked kernel memory until patching is complete.

bash

# Verify current kernel version and XFS mount options
uname -r
mount | grep xfs

# Check for quota-enabled XFS mounts that are exposed to the bug
findmnt -t xfs -o TARGET,OPTIONS | grep -E 'uquota|gquota|pquota'

# After patching, confirm the kernel package version
rpm -q kernel   # RHEL/CentOS/Fedora
dpkg -l | grep linux-image   # Debian/Ubuntu