CVE-2026-97544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97544", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.154Z", "datePublished": "2026-09-25T10:21:39.839Z", "dateUpdated": "2026-10-19T09:09:06.381Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:06.381Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't leak dqacct if rhashtable insertion fails\n\nLOLLM observes that xqcheck_mod_live_ino_dqtrx doesn't free the newly\nallocated dqa object if rhashtable insertion fails. Fix this leak."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/scrub/quotacheck.c"], "versions": [{"version": "200491875ce144fdc49827387fff2f604b73c0a9", "lessThan": "9036e078bd51683e862afd5ed25ecba2f780b165", "status": "affected", "versionType": "git"}, {"version": "200491875ce144fdc49827387fff2f604b73c0a9", "lessThan": "7791970a76a3e23f6f51451dbb1e48bd57f94f93", "status": "affected", "versionType": "git"}, {"version": "200491875ce144fdc49827387fff2f604b73c0a9", "lessThan": "788c3a46ef9d79f875312b95cffe0961a13167a7", "status": "affected", "versionType": "git"}, {"version": "200491875ce144fdc49827387fff2f604b73c0a9", "lessThan": "2eac8d01d2c776fc26b0ac74aebdf91bc4490891", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/scrub/quotacheck.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9036e078bd51683e862afd5ed25ecba2f780b165"}, {"url": "https://git.kernel.org/stable/c/7791970a76a3e23f6f51451dbb1e48bd57f94f93"}, {"url": "https://git.kernel.org/stable/c/788c3a46ef9d79f875312b95cffe0961a13167a7"}, {"url": "https://git.kernel.org/stable/c/2eac8d01d2c776fc26b0ac74aebdf91bc4490891"}], "title": "xfs: don't leak dqacct if rhashtable insertion fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/xfs/scrub/quotacheck.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9036e078bd51683e862afd5ed25ecba2f780b165", "status": "affected", "version": "200491875ce144fdc49827387fff2f604b73c0a9", "versionType": "git"}, {"lessThan": "7791970a76a3e23f6f51451dbb1e48bd57f94f93", "status": "affected", "version": "200491875ce144fdc49827387fff2f604b73c0a9", "versionType": "git"}, {"lessThan": "788c3a46ef9d79f875312b95cffe0961a13167a7", "status": "affected", "version": "200491875ce144fdc49827387fff2f604b73c0a9", "versionType": "git"}, {"lessThan": "2eac8d01d2c776fc26b0ac74aebdf91bc4490891", "status": "affected", "version": "200491875ce144fdc49827387fff2f604b73c0a9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/xfs/scrub/quotacheck.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't leak dqacct if rhashtable insertion fails\n\nLOLLM observes that xqcheck_mod_live_ino_dqtrx doesn't free the newly\nallocated dqa object if rhashtable insertion fails. Fix this leak."}], "id": "CVE-2026-97544", "lastModified": "2026-10-19T10:17:23.437", "metrics": {}, "published": "2026-09-25T11:17:04.753", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2eac8d01d2c776fc26b0ac74aebdf91bc4490891"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7791970a76a3e23f6f51451dbb1e48bd57f94f93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/788c3a46ef9d79f875312b95cffe0961a13167a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9036e078bd51683e862afd5ed25ecba2f780b165"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xfs: don't leak dqacct if rhashtable insertion fails", "id": "2541040", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541040"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxfs: don't leak dqacct if rhashtable insertion fails\nLOLLM observes that xqcheck_mod_live_ino_dqtrx doesn't free the newly\nallocated dqa object if rhashtable insertion fails. Fix this leak.", "A flaw was found in the Linux kernel's XFS file system. This flaw allows a local user to cause a Denial of Service (DoS) through kernel memory exhaustion. The issue occurs during live quota check operations when memory allocated for quota tracking is not freed if an internal hash table insertion fails."], "name": "CVE-2026-97544", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97544\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97544\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97544.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[200491875ce144fdc49827387fff2f604b73c0a9,9036e078bd51683e862afd5ed25ecba2f780b165)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[200491875ce144fdc49827387fff2f604b73c0a9,7791970a76a3e23f6f51451dbb1e48bd57f94f93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[200491875ce144fdc49827387fff2f604b73c0a9,788c3a46ef9d79f875312b95cffe0961a13167a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[200491875ce144fdc49827387fff2f604b73c0a9,2eac8d01d2c776fc26b0ac74aebdf91bc4490891)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T22:45:15.068927+00:00", "updated": "2026-10-01T12:00:06.840884+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}