{"id":"CVE-2026-64356","summary":"xfs: fix memory leak in xfs_dqinode_metadir_create()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix memory leak in xfs_dqinode_metadir_create()\n\nIf xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current\ncode returns directly, leaking the allocated update and transaction state.\nIf the subsequent commit fails, the caller-owned inode reference is left\nbehind.\n\nFix this memory leak by routing the create failure path through\nxfs_metadir_cancel().  For both create and commit failures, finish and\nrelease any inode returned to the caller, mirroring the unwind pattern in\nxfs_metadir_mkdir().\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. Runtime validation\nused kprobe fault injection during `mount -o uquota` on a metadir XFS\nimage. Injecting xfs_metadir_create() reproduced the old active-update path\nthat left mount stuck later in mount setup; after this change, the same\ninjection reported cancel_hits=1 and irele_hits=1. Injecting\nxfs_metadir_commit() exercised the old inode-reference leak path; after\nthis change, it reported irele_hits=1.","modified":"2026-07-27T04:03:21.470891168Z","published":"2026-07-25T08:50:14.049Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64356.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/06a2e6dbaa26c0740ac76dfa66b0aedc78d05820"},{"type":"WEB","url":"https://git.kernel.org/stable/c/45de375b25060edf46e20abb36521ba530336ceb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64356.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64356"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e80fbe1ad8eff7d7d1363e14f1e493d84dd37c84"},{"fixed":"c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1"},{"fixed":"06a2e6dbaa26c0740ac76dfa66b0aedc78d05820"},{"fixed":"45de375b25060edf46e20abb36521ba530336ceb"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64356.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64356.json"}}],"schema_version":"1.7.5"}