EUVD-2026-103687

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

CVE-2026-98447

The Linux kernel contains a vulnerability in the xfs filesystem where the inode btree root formatting methods perform a wild memcpy access . The root cause is that these methods copy too many bytes because there is only one set of keys in node blocks instead of two, leading to memory corruption o...

CVE-2026-98447 xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

CVE-2026-98447 xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

EUVD-2026-103686

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

CVE-2026-98446

The Linux kernel contains a vulnerability in the xfs filesystem. Specifically, within xfs_metafile_resv_init , if the reservable fdblocks for a metadata btree file falls below the space already used by that file, a hidden_space subtraction can underflow . This underflow causes xfs_dec_fdblocks to...

CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

EUVD-2026-103685

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

CVE-2026-98445

The Linux kernel XFS filesystem contains a vulnerability where a memory allocation failure in xrep_newbt_add_blocks causes online repairs to leak blocks previously allocated for a new btree. Due to codebase limitations, callers cannot undo the transaction and return an error, which could otherwis...

EUVD-2026-103684

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

CVE-2026-98444 xfs: drop dquot flush lock when we can't find a buffer to flush

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

CVE-2026-98444

The Linux kernel contains a vulnerability in the xfs filesystem where the xfs_qm_flush_one function fails to release the dquot flush lock (dqflock) when it is unable to acquire the associated buffer. Because the lock remains held when no buffer exists for other processes to release it, the system...

CVE-2026-98444 xfs: drop dquot flush lock when we can't find a buffer to flush

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

EUVD-2026-103683

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

CVE-2026-98443 xfs: fix cursor and pointer handling when recovering iunlink buckets

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

CVE-2026-98443

The Linux kernel 's XFS filesystem component contained several bugs in the xlog_recover_iunlink_bucket function. Specifically, failing to null out prev_ip after release could lead to Use-After-Free (UAF) issues if an inodegc flush failed. Additionally, the code could leak @ip on flush failures an...

CVE-2026-98443 xfs: fix cursor and pointer handling when recovering iunlink buckets

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...