CVE-2026-98443 Overview
CVE-2026-98443 is a Linux kernel vulnerability in the XFS filesystem's log recovery code. The flaw resides in xlog_recover_iunlink_bucket, which recovers unlinked inode buckets during filesystem recovery. The function mishandles cursor and pointer state after calls to the inodegc flush routine. If the flush fails inside the loop, the code can trigger a use-after-free (UAF) on prev_ip, leak the current ip reference, and corrupt the unlinked inode list by creating self-referential entries. The issue was reported by LOLLM and resolved across multiple stable kernel branches.
Critical Impact
Faulty cursor handling during XFS log recovery can cause use-after-free conditions, inode reference leaks, and self-looping unlinked inode lists.
Affected Products
- Linux kernel (XFS filesystem recovery subsystem)
- Distributions shipping kernels that include xlog_recover_iunlink_bucket prior to the fix
- Stable kernel trees referenced by commits 47a948b, 65f39d0, 66a2179, 8c9d5b8, and 961c717
Discovery Timeline
- 2026-10-18 - CVE-2026-98443 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98443
Vulnerability Analysis
The vulnerability affects XFS log recovery, specifically the routine that walks per-AG (Allocation Group) unlinked inode buckets. During recovery, XFS iterates each unlinked inode, flushes pending inodegc work, and advances a cursor to the next entry. The original implementation contained four distinct defects that compromise memory safety and on-disk list integrity.
First, prev_ip is not nulled after being released. If the subsequent inodegc flush call fails, the loop can dereference the already-released pointer, producing a classic use-after-free. Second, when the inodegc flush inside the loop fails, the current inode reference ip is leaked. Third, prev_agino is assigned from agino after agino has already been advanced, causing an inode to record itself as its own i_prev_unlinked predecessor. Fourth, if the loop exits while prev_ip still aliases ip, the same self-referential corruption occurs.
Root Cause
The root cause is improper cursor and pointer lifecycle management inside the recovery loop. Pointer ownership is not reset after release, failure paths do not drop acquired references, and the order of cursor advancement versus prev_agino assignment is inverted. These errors combine to produce memory-safety and list-integrity bugs.
Attack Vector
Exploitation requires triggering XFS log recovery on a filesystem that contains unlinked inodes queued for cleanup, combined with an inodegc flush failure. This typically occurs during mount of a crashed or malformed XFS volume. Local attackers with the ability to supply or craft an XFS image, or administrators mounting a corrupted volume, could reach the vulnerable code path. The resulting UAF is a kernel-space memory safety defect. See the upstream fixes in Kernel Commit 47a948b and Kernel Commit 961c717 for the corrected cursor and pointer handling.
Detection Methods for CVE-2026-98443
Indicators of Compromise
- Kernel oops or panic messages referencing xlog_recover_iunlink_bucket or XFS recovery functions during mount
- Repeated inodegc flush failures logged by the XFS subsystem
- Filesystem corruption reports showing inodes whose i_prev_unlinked field references the inode itself
- Unexpected mount failures on XFS volumes following a crash or power loss
Detection Strategies
- Monitor dmesg and /var/log/kern.log for XFS recovery errors and use-after-free indicators from KASAN-enabled kernels
- Enable CONFIG_KASAN in test environments to surface memory safety violations in the recovery path
- Track installed kernel versions against the fixed stable branches referenced in the kernel.org commits
Monitoring Recommendations
- Alert on kernel crashes or stack traces that include XFS log recovery symbols
- Collect and centralize kernel logs from Linux endpoints and servers for post-incident analysis
- Audit mount operations on XFS volumes to detect abnormal failure rates following unplanned reboots
How to Mitigate CVE-2026-98443
Immediate Actions Required
- Apply the vendor kernel update that includes the fix for xlog_recover_iunlink_bucket
- Reboot systems after kernel patch installation to activate the corrected recovery code
- Avoid mounting untrusted or externally supplied XFS images on production hosts
Patch Information
The fix is distributed across multiple stable kernel branches. Relevant commits include Kernel Commit 47a948b, Kernel Commit 65f39d0, Kernel Commit 66a2179, Kernel Commit 8c9d5b8, and Kernel Commit 961c717. The patches null prev_ip after release, correctly handle inodegc flush failures without leaking ip, and reorder cursor advancement so prev_agino is set before agino is updated.
Workarounds
- Restrict XFS mounts to trusted, administrator-controlled block devices until the kernel is patched
- Ensure clean shutdown procedures to minimize XFS log recovery during subsequent boots
- Use filesystem integrity tooling such as xfs_repair on suspect volumes offline rather than relying on mount-time recovery
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
