Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfs_dqinode_metadir_create() If xfs_metadir_create()… (CVE-2026-64356)
A memory leak vulnerability in the Linux kernel's XFS filesystem code (specifically in xfs_dqinode_metadir_create) has been fixed. The issue occurs when xfs_metadir_create() fails and the code returns without properly releasing allocated resources, leading to memory leaks. This flaw was identified through experimental kernel memory-management analysis and affects certain Linux kernel versions prior to 7.0.0-31.31 and related builds. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not impact confidentiality or integrity but affects availability due to the memory leak. Official patches are available and included in Linux kernel updates for Ubuntu 24.04 LTS and related distributions. Users should update to the fixed kernel versions to remediate the issue.
AI Analysis
Technical Summary
The Linux kernel contained a memory leak vulnerability in the XFS filesystem code within the function xfs_dqinode_metadir_create(). If the helper function xfs_metadir_create() failed, the existing code path returned immediately without freeing allocated update and transaction state, causing a memory leak. Additionally, if a subsequent commit failed, the inode reference was not properly released. The fix routes failure paths through xfs_metadir_cancel() to ensure proper cleanup, mirroring the existing unwind pattern in xfs_metadir_mkdir(). This bug was detected by an experimental kernel memory-management analysis tool during examination of kernel version v6.13-rc1 and confirmed to persist in v7.1.1. The vulnerability is tracked as CVE-2026-64356 with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector with low complexity and no confidentiality or integrity impact but causing availability impact due to memory leaks. The issue affects Linux kernel versions prior to 7.0.0-31.31 and related Ubuntu kernel builds. Official patches have been released by Ubuntu and Canonical, requiring system updates and kernel module recompilation due to ABI changes.
Potential Impact
The vulnerability causes a memory leak in the Linux kernel's XFS filesystem code, which can degrade system availability by exhausting memory resources over time. There is no direct impact on confidentiality or integrity. The flaw requires local access with low privileges and does not involve user interaction. No known exploits are reported in the wild. The medium severity rating reflects the potential for denial-of-service conditions due to resource exhaustion.
Mitigation Recommendations
A patch is available and has been released by Ubuntu and Canonical as part of Linux kernel updates for Ubuntu 24.04 LTS and related distributions. Users should update their systems to the fixed kernel versions listed in the vendor advisories (e.g., linux-image-7.0.0-31.31 and later). Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required after updating. After applying the update, a system reboot is necessary to complete remediation. No additional mitigation steps are required beyond applying the official fix.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfs_dqinode_metadir_create() If xfs_metadir_create()… (CVE-2026-64356)
Description
A memory leak vulnerability in the Linux kernel's XFS filesystem code (specifically in xfs_dqinode_metadir_create) has been fixed. The issue occurs when xfs_metadir_create() fails and the code returns without properly releasing allocated resources, leading to memory leaks. This flaw was identified through experimental kernel memory-management analysis and affects certain Linux kernel versions prior to 7.0.0-31.31 and related builds. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not impact confidentiality or integrity but affects availability due to the memory leak. Official patches are available and included in Linux kernel updates for Ubuntu 24.04 LTS and related distributions. Users should update to the fixed kernel versions to remediate the issue.
CVSS v3.1
Score 5.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel contained a memory leak vulnerability in the XFS filesystem code within the function xfs_dqinode_metadir_create(). If the helper function xfs_metadir_create() failed, the existing code path returned immediately without freeing allocated update and transaction state, causing a memory leak. Additionally, if a subsequent commit failed, the inode reference was not properly released. The fix routes failure paths through xfs_metadir_cancel() to ensure proper cleanup, mirroring the existing unwind pattern in xfs_metadir_mkdir(). This bug was detected by an experimental kernel memory-management analysis tool during examination of kernel version v6.13-rc1 and confirmed to persist in v7.1.1. The vulnerability is tracked as CVE-2026-64356 with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector with low complexity and no confidentiality or integrity impact but causing availability impact due to memory leaks. The issue affects Linux kernel versions prior to 7.0.0-31.31 and related Ubuntu kernel builds. Official patches have been released by Ubuntu and Canonical, requiring system updates and kernel module recompilation due to ABI changes.
Potential Impact
The vulnerability causes a memory leak in the Linux kernel's XFS filesystem code, which can degrade system availability by exhausting memory resources over time. There is no direct impact on confidentiality or integrity. The flaw requires local access with low privileges and does not involve user interaction. No known exploits are reported in the wild. The medium severity rating reflects the potential for denial-of-service conditions due to resource exhaustion.
Mitigation Recommendations
A patch is available and has been released by Ubuntu and Canonical as part of Linux kernel updates for Ubuntu 24.04 LTS and related distributions. Users should update their systems to the fixed kernel versions listed in the vendor advisories (e.g., linux-image-7.0.0-31.31 and later). Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required after updating. After applying the update, a system reboot is necessary to complete remediation. No additional mitigation steps are required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p28w-6j9h-mmp2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64356"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420c9c2644c7f808504b
Added to database: 07/25/2026, 23:09:00 UTC
Last enriched: 09/07/2026, 18:06:57 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.