CVE-2026-64356

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: fix memory leak in xfs_dqinode_metadir_create()<br /> <br /> If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current<br /> code returns directly, leaking the allocated update and transaction state.<br /> If the subsequent commit fails, the caller-owned inode reference is left<br /> behind.<br /> <br /> Fix this memory leak by routing the create failure path through<br /> xfs_metadir_cancel(). For both create and commit failures, finish and<br /> release any inode returned to the caller, mirroring the unwind pattern in<br /> xfs_metadir_mkdir().<br /> <br /> The bug was first flagged by an experimental analysis tool we are<br /> developing for kernel memory-management bugs while analyzing<br /> v6.13-rc1. The tool is still under development and is not yet publicly<br /> available. Manual inspection confirms that the bug is still<br /> present in v7.1.1.<br /> <br /> An x86_64 allyesconfig build showed no new warnings. Runtime validation<br /> used kprobe fault injection during `mount -o uquota` on a metadir XFS<br /> image. Injecting xfs_metadir_create() reproduced the old active-update path<br /> that left mount stuck later in mount setup; after this change, the same<br /> injection reported cancel_hits=1 and irele_hits=1. Injecting<br /> xfs_metadir_commit() exercised the old inode-reference leak path; after<br /> this change, it reported irele_hits=1.