In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM… (CVE-2026-98443)

The vulnerability in the Linux kernel's XFS filesystem involved improper handling of pointers and cursors during recovery of iunlink buckets in the xlog_recover_iunlink_bucket function. Specifically, the code failed to null out a pointer after releasing it, leading to potential use-after-free (UAF) issues if the inode garbage collection flush call failed. Additionally, failure of the flush call caused memory leaks. The logic also incorrectly set inode pointers, resulting in loops in the unlinked inode list. These loops did not typically cause issues due to immediate flushing of unlinked inodes after loading. The fix addressed all these pointer handling and cursor management bugs.

The bugs could lead to use-after-free conditions and memory leaks within the XFS filesystem recovery process, potentially causing instability or corruption during inode unlink recovery. The creation of loops in the unlinked inode list could further complicate inode management. However, the immediate flushing of unlinked inodes mitigated the manifestation of these loops. There is no indication of active exploitation or direct security compromise from this vulnerability.

A fix has been implemented in the Linux kernel to correct the pointer and cursor handling bugs in the xlog_recover_iunlink_bucket function. Users should apply the official kernel updates that include this fix once available. No additional mitigation steps are indicated beyond applying the patch.