CVE-2026-97545: Linux Kernel XFS Buffer Leak Vulnerability

CVE-2026-97545 Overview

CVE-2026-97545 is a resource leak vulnerability in the Linux kernel's XFS filesystem code. The flaw resides in xfs_btree_bload_prep_block, where a failure path in xfs_btree_bload_drop_buf fails to release a newly allocated buffer. When writing the delwri (delayed write) buffer list to disk returns an I/O error, the kernel loses track of a locked buffer referenced by new_bp.

The leak occurs during B-tree bulk loading, a code path used during online repair and similar XFS maintenance operations. Each leaked buffer remains locked, which can degrade filesystem performance and complicate recovery after transient I/O errors.

Critical Impact
A locked XFS buffer is leaked whenever delwri buffer flushing fails during B-tree bulk loading, potentially leading to resource exhaustion and filesystem contention on affected kernels.

Affected Products

Linux kernel versions containing the XFS xfs_btree_bload_prep_block code path
Stable kernel branches prior to the referenced patch commits
Distributions shipping unpatched upstream XFS code

Discovery Timeline

2026-09-25 - CVE-2026-97545 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-97545

Vulnerability Analysis

The defect sits in the XFS B-tree bulk load helper xfs_btree_bload_prep_block. During bulk loading, the function allocates a new buffer (new_bp) and then calls xfs_btree_bload_drop_buf to flush any pending delayed-write buffers before continuing. The drop helper may issue I/O against the delwri list and surface an error back to the caller when the write fails.

The original code treated this error path as fatal and returned without releasing new_bp. Because the buffer is held with a lock at this point, the leak removes it from the free pool and keeps the lock held indefinitely. Repeated failures compound the problem, pinning additional buffers and reducing cache capacity.

The condition is reachable only during XFS operations that drive bulk B-tree construction, such as online repair (xfs_repair kernel paths) and filesystem conversions. Triggering it also requires an I/O error on the underlying storage during the delwri flush.

Root Cause

The root cause is missing cleanup in an error-handling branch. When xfs_btree_bload_drop_buf returns an error, control exits xfs_btree_bload_prep_block without calling the buffer release routine for new_bp. The fix adds the missing release so the locked buffer is returned to the pool before propagating the error.

Attack Vector

This is a reliability and resource-management defect rather than a directly exploitable memory corruption flaw. Exploitation requires both local filesystem activity that drives bulk B-tree construction and underlying storage that returns I/O errors during delwri flushing. There is no network attack vector, no known public proof of concept, and no entry in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability is described in the upstream commit message and is addressed by patch commits 176a53af, 355b8a5d, b19dfd45, and f1930bc5 on git.kernel.org. See the Linux Kernel Patch 176a53af for the authoritative fix.

Detection Methods for CVE-2026-97545

Indicators of Compromise

Kernel log messages from XFS reporting delwri buffer write failures correlated with online repair or bulk B-tree load operations.
Growing counts of locked XFS buffers that are not released after I/O errors, visible via /proc/slabinfo and XFS stats under /sys/fs/xfs/.
Repeated xfs_buf warnings or hangs during xfs_scrub or xfs_repair activity.

Detection Strategies

Audit running kernel versions against the fixed commits listed on git.kernel.org to identify unpatched hosts.
Monitor XFS error counters and dmesg for I/O errors on devices that back XFS filesystems undergoing online repair.
Track buffer cache utilization trends to flag unexplained growth that may indicate leaked locked buffers.

Monitoring Recommendations

Centralize kernel logs and alert on XFS error strings tied to xfs_btree_bload and delwri flush failures.
Collect filesystem telemetry (buffer counts, lock contention) from Linux hosts running XFS at scale.
Correlate storage subsystem I/O errors with filesystem-level anomalies to detect compound failures early.

How to Mitigate CVE-2026-97545

Immediate Actions Required

Inventory Linux hosts running XFS and identify kernel builds that predate the referenced patch commits.
Apply vendor-provided kernel updates that include the fix for xfs_btree_bload_prep_block.
Prioritize patching on systems that routinely run xfs_scrub, xfs_repair, or workloads that trigger B-tree bulk loads.

Patch Information

The fix releases new_bp on the xfs_btree_bload_drop_buf error path. Upstream commits are available at Linux Kernel Patch 176a53af, Linux Kernel Patch 355b8a5d, Linux Kernel Patch b19dfd45, and Linux Kernel Patch f1930bc5. Distribution kernels should pick up the backports in subsequent stable releases.

Workarounds

Address underlying storage reliability issues so delwri buffer flushes do not fail, removing the trigger condition.
Avoid running online XFS repair operations on filesystems backed by unreliable storage until the patch is deployed.
Reboot affected hosts to reclaim leaked locked buffers if performance degradation is observed before patching.

bash

# Verify kernel version and check for the fix commits
uname -r

# Inspect XFS stats for signs of buffer pressure
cat /proc/fs/xfs/stat

# Monitor kernel ring buffer for XFS and I/O errors
dmesg -T | grep -Ei 'xfs|I/O error'