Linux Kernel XFS: Use-after-free and resource leak in iunlink recovery
Summary
The XFS filesystem code of the Linux kernel, used during unlinked-inode recovery (xlog_recover_iunlink_bucket) at mount or log replay, contains several bugs. A pointer is not cleared after release, which can lead to a use-after-free if an inodegc flush fails, an inode is leaked on that error path, and cursor handling can create loops in the unlinked list. A local user who can trigger XFS recovery, for example by mounting a crafted XFS image, could cause memory corruption that may lead to a crash or possibly privilege escalation.
Affected
- Linux kernel from commit 04755d2e5821b3afbaadd09fe5df58d04de36484 up to the fixed commits listed in the CVE record
- Linux kernel 6.0 up to (excluding) 6.1.191, 6.6.160, 6.12.113, 6.18.55 and 7.2.9 (per CNA data; 7.3 and later listed as affected by default)
- Distribution kernels: Ubuntu lists 24.04 LTS and 26.04 LTS as vulnerable, and linux-hwe-6.8 on 22.04 LTS; other distributions: Unknown.
Fixed in
- Linux kernel 6.1.191, 6.6.160, 6.12.113, 6.18.55 and 7.2.9 (stable branches)
- Ubuntu 24.04 LTS: fix in progress in 6.8.0-149.149i1
- Ubuntu 26.04 LTS: fix in progress in 7.0.0-42.42
- Other distributions: Unknown.
Workaround
- No vendor workaround known.
- Limit local shell access on hosts that use XFS.
- Do not mount untrusted or unknown XFS images on production systems.
Exploitation
- No evidence of exploitation in the wild or public proof of concept known at the time of review.
- Ubuntu rates the issue Medium priority; EPSS score is very low (0.00168).
Our recommendation
- Identify hosts that run XFS and note their kernel versions, especially file servers and systems that mount external XFS media.
- Install the vendor kernel update containing the fix as part of the next regular kernel update cycle, and reboot afterwards.
- Restrict local access to affected systems and avoid mounting untrusted XFS media.
- Check the vendor advisory for your distribution and NVD for the final CVSS score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 47a948ba653a463d429e02fda2f06a3d6b78666d git.kernel.org
- Linux stable commit 65f39d09d73718611cee40399179323b5d4ead00 git.kernel.org
- Linux stable commit 8cfde7b2fb7288f4f6b90293e8702ff897c682fe git.kernel.org
- Ubuntu security tracker CVE-2026-98443 ubuntu.com
- OSV CVE-2026-98443 osv.dev
- Red Hat CVE entry via Vulners vulners.com
- NVD entry via Vulners vulners.com
- Strix CVE-2026-98443 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:47.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releasing it, which can lead to UAF problems if the inodegc flush call in the loop fails. at which point I noticed even more bugs: 2. If the inodegc flush inside the loop fails, we also leak @ip. 3. We set prev_agino to agino having already advanced agino, which results in inodes with i_prev_unlinked set to itself. 4. If we exit the bottom of the loop with prev_ip set, then prev_ip aliases ip and we also set its i_prev_unlinked to itself. Bugs 3 and 4 introduce loops into the unlinked list, though these loops don't surface because we immediately flush each unlinked inode after loading it. Fix all of these issues.
NVD references (6)
- https://git.kernel.org/stable/c/47a948ba653a463d429e02fda2f06a3d6b78666d
- https://git.kernel.org/stable/c/65f39d09d73718611cee40399179323b5d4ead00
- https://git.kernel.org/stable/c/66a2179d02668f8df44b1a249899006f3ba38ea0
- https://git.kernel.org/stable/c/8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1
- https://git.kernel.org/stable/c/8cfde7b2fb7288f4f6b90293e8702ff897c682fe
- https://git.kernel.org/stable/c/961c717e6bf0e53c2c2b1fe4aef1add9390fedab
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.