EUVD-2026-103687

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

CVE-2026-98446

The Linux kernel contains a vulnerability in the xfs filesystem. Specifically, within xfs_metafile_resv_init , if the reservable fdblocks for a metadata btree file falls below the space already used by that file, a hidden_space subtraction can underflow . This underflow causes xfs_dec_fdblocks to...

CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

EUVD-2026-103686

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

EUVD-2026-103685

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

CVE-2026-98445

The Linux kernel XFS filesystem contains a vulnerability where a memory allocation failure in xrep_newbt_add_blocks causes online repairs to leak blocks previously allocated for a new btree. Due to codebase limitations, callers cannot undo the transaction and return an error, which could otherwis...

CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

CVE-2026-98444

The Linux kernel contains a vulnerability in the xfs filesystem where the xfs_qm_flush_one function fails to release the dquot flush lock (dqflock) when it is unable to acquire the associated buffer. Because the lock remains held when no buffer exists for other processes to release it, the system...

CVE-2026-98444 xfs: drop dquot flush lock when we can't find a buffer to flush

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

CVE-2026-98444 xfs: drop dquot flush lock when we can't find a buffer to flush

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

EUVD-2026-103684

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

CVE-2026-98443 xfs: fix cursor and pointer handling when recovering iunlink buckets

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

EUVD-2026-103683

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

CVE-2026-98443

A flaw in the Linux kernel's XFS file system regarding cursor and pointer handling during the recovery of iunlink buckets allows for a use-after-free (UAF) condition. Specifically, in xlog_recover_iunlink_bucket, failing to null out prev_ip after release can lead to UAF if an inodegc flush call f...

CVE-2026-98443 xfs: fix cursor and pointer handling when recovering iunlink buckets

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

EUVD-2026-103682

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

CVE-2026-98442 net/sched: act_ct: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

CVE-2026-98442

The Linux kernel contains a use-after-free (UAF) vulnerability within the traffic control connection tracking action (act_ct) . The flaw occurs because connection tracking helpers record a raw pointer to the extensions area into the expectations list before all extensions are added; if additional...