In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025… (CVE-2026-64146)
In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array. Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak. Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.
AI Analysis
Technical Summary
The Linux kernel's erofs filesystem had a vulnerability (CVE-2026-64146) where the metabuf used in inode xattr initialization could leak due to improper cleanup on certain error paths after calling erofs_read_metabuf(). Specifically, the metabuf reference was not dropped before exiting via out_unlock, causing a folio reference leak. The fix consolidates cleanup at out_unlock, ensuring erofs_put_metabuf() is called when needed, preventing the leak.
Potential Impact
The vulnerability causes a memory leak in kernel space related to the erofs filesystem's handling of inode extended attributes. While this does not directly indicate code execution or privilege escalation, memory leaks in kernel code can degrade system stability or lead to resource exhaustion over time.
Mitigation Recommendations
A fix has been applied in the Linux kernel source code to address this metabuf leak. Since no explicit patch links or vendor advisories are provided, users should update to the Linux kernel version that includes commit bb88e8da0025 or later. Patch status is not yet confirmed from vendor advisories; check the official Linux kernel repositories or vendor advisories for the fixed version and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025… (CVE-2026-64146)
Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array. Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak. Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's erofs filesystem had a vulnerability (CVE-2026-64146) where the metabuf used in inode xattr initialization could leak due to improper cleanup on certain error paths after calling erofs_read_metabuf(). Specifically, the metabuf reference was not dropped before exiting via out_unlock, causing a folio reference leak. The fix consolidates cleanup at out_unlock, ensuring erofs_put_metabuf() is called when needed, preventing the leak.
Potential Impact
The vulnerability causes a memory leak in kernel space related to the erofs filesystem's handling of inode extended attributes. While this does not directly indicate code execution or privilege escalation, memory leaks in kernel code can degrade system stability or lead to resource exhaustion over time.
Mitigation Recommendations
A fix has been applied in the Linux kernel source code to address this metabuf leak. Since no explicit patch links or vendor advisories are provided, users should update to the Linux kernel version that includes commit bb88e8da0025 or later. Patch status is not yet confirmed from vendor advisories; check the official Linux kernel repositories or vendor advisories for the fixed version and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-556c-3r39-wvfx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64146"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912b21f
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:46:16 UTC
Last updated: 09/01/2026, 22:52:13 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.