PT-2026-61463 · Linux · Linux

CVE-2026-64146 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix metabuf leak in inode xattr initialization

commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs buf instances. erofs init inode xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array.

Some error paths after erofs read metabuf() leave through out unlock without dropping the metabuf, so the folio reference can leak.

Consolidate the cleanup at out unlock. erofs put metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS I BL XATTR BIT covered by a single cleanup site.

Identificadores relacionados

CVE-2026-64146

Produtos afetados

Linux

Referências · 3

• https://git.kernel.org/stable/c/79b09c54c6563df9846ca3094bcfd72082c3e1d7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64146 · Nota de Segurança
• https://git.kernel.org/stable/c/492c73b21fefa36f3869cb2b188ffb7fe37b3a9b · Nota