The vulnerability in the Linux kernel's XFS filesystem involves a memory leak in xfs_dqinode_metadir_create() due to improper handling of failure paths in xfs_metadir_create() and subsequent commit operations. When xfs_metadir_create() fails, the code previously returned directly, leaking allocated update and transaction state. If the commit operation fails afterward, the inode reference owned by the caller was not released. The fix ensures that failure paths are routed through xfs_metadir_cancel(), which properly finishes and releases any inode returned to the caller, following the established unwind pattern used in xfs_metadir_mkdir(). The bug was identified during analysis of kernel version 6.13-rc1 and confirmed to persist in version 7.1.1. Testing with fault injection during mounting with user quotas on XFS metadirs demonstrated the fix's effectiveness in preventing resource leaks and mount hangs.

The vulnerability causes memory leaks in the kernel's XFS filesystem code, which could lead to resource exhaustion or system instability during quota-enabled mounts on XFS metadirs. While no direct exploit in the wild is known, the leak could degrade system performance or cause mount operations to hang under certain fault conditions.

A fix for this vulnerability has been implemented in the Linux kernel by routing failure paths through xfs_metadir_cancel() to properly release allocated resources. Users should update to a Linux kernel version that includes this fix. Since no patch links or specific fixed versions are provided, check the vendor or kernel mailing list advisories for the exact fixed version. No additional mitigation steps are indicated.