CVE-2026-98443

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98443", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.349Z", "datePublished": "2026-10-18T15:14:53.597Z", "dateUpdated": "2026-10-30T12:38:08.950Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:08.950Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n problems if the inodegc flush call in the loop fails.\n\nat which point I noticed even more bugs:\n\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n\n3. We set prev_agino to agino having already advanced agino, which\n results in inodes with i_prev_unlinked set to itself.\n\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\n aliases ip and we also set its i_prev_unlinked to itself.\n\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\n\nFix all of these issues."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Malformed agi_unlinked, di_next_unlinked, and inode-fork data enter from a local XFS image when mount(2) reaches xlog_recover_iunlink_bucket through xfs_log_mount_finish and xlog_recover_finish; no remote protocol carries these bytes.\nAC:L - The image author can create a dirty log, two inodes in one unlinked bucket, and corrupt external btree metadata that makes xfs_inactive fail through xfs_inodegc_flush. This deterministically enters the stale-prev_ip error path without requiring an uncontrollable hardware fault.\nPR:N - The attacker only creates and supplies the XFS image, requiring no target account or capability. XFS omits FS_USERNS_MOUNT, so the privileged mount_capable check applies to the interacting victim and is captured by UI:R.\nUI:R - A victim or administrator must mount the attacker-supplied dirty XFS image so xfs_log_mount_finish invokes xlog_recover_finish and the patched xlog_recover_iunlink_bucket.\nS:U - The stale xfs_inode and resulting memory corruption affect the mounting host kernel within its existing security authority; no VM, IOMMU, or other isolation boundary is crossed.\nC:H - After xfs_inodegc_flush makes prev_ip reclaimable, the stale pointer can reference an xfs_inode_cache object reclaimed and replaced before the second xfs_irele; reuse and secondary UAF of the replacement inode support kernel-memory disclosure.\nI:H - The second xfs_irele can decrement i_count in a reused xfs_inode, prematurely destroying a live replacement inode and producing secondary use-after-free memory corruption exploitable for control-flow hijacking.\nA:H - The stale xfs_irele can dereference a freed inode or underflow its reference count; DEBUG_VFS BUGs on the invalid inode state/count, while non-debug builds can corrupt a replacement inode and later oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/xfs_log_recover.c"], "versions": [{"version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "lessThan": "8cfde7b2fb7288f4f6b90293e8702ff897c682fe", "status": "affected", "versionType": "git"}, {"version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "lessThan": "47a948ba653a463d429e02fda2f06a3d6b78666d", "status": "affected", "versionType": "git"}, {"version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "lessThan": "8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1", "status": "affected", "versionType": "git"}, {"version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "lessThan": "66a2179d02668f8df44b1a249899006f3ba38ea0", "status": "affected", "versionType": "git"}, {"version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "lessThan": "961c717e6bf0e53c2c2b1fe4aef1add9390fedab", "status": "affected", "versionType": "git"}, {"version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "lessThan": "65f39d09d73718611cee40399179323b5d4ead00", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/xfs/xfs_log_recover.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8cfde7b2fb7288f4f6b90293e8702ff897c682fe"}, {"url": "https://git.kernel.org/stable/c/47a948ba653a463d429e02fda2f06a3d6b78666d"}, {"url": "https://git.kernel.org/stable/c/8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1"}, {"url": "https://git.kernel.org/stable/c/66a2179d02668f8df44b1a249899006f3ba38ea0"}, {"url": "https://git.kernel.org/stable/c/961c717e6bf0e53c2c2b1fe4aef1add9390fedab"}, {"url": "https://git.kernel.org/stable/c/65f39d09d73718611cee40399179323b5d4ead00"}], "title": "xfs: fix cursor and pointer handling when recovering iunlink buckets", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/xfs/xfs_log_recover.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8cfde7b2fb7288f4f6b90293e8702ff897c682fe", "status": "affected", "version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "versionType": "git"}, {"lessThan": "47a948ba653a463d429e02fda2f06a3d6b78666d", "status": "affected", "version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "versionType": "git"}, {"lessThan": "8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1", "status": "affected", "version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "versionType": "git"}, {"lessThan": "66a2179d02668f8df44b1a249899006f3ba38ea0", "status": "affected", "version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "versionType": "git"}, {"lessThan": "961c717e6bf0e53c2c2b1fe4aef1add9390fedab", "status": "affected", "version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "versionType": "git"}, {"lessThan": "65f39d09d73718611cee40399179323b5d4ead00", "status": "affected", "version": "04755d2e5821b3afbaadd09fe5df58d04de36484", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/xfs/xfs_log_recover.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n problems if the inodegc flush call in the loop fails.\n\nat which point I noticed even more bugs:\n\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n\n3. We set prev_agino to agino having already advanced agino, which\n results in inodes with i_prev_unlinked set to itself.\n\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\n aliases ip and we also set its i_prev_unlinked to itself.\n\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\n\nFix all of these issues."}], "id": "CVE-2026-98443", "lastModified": "2026-10-30T13:21:13.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:16:54.620", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47a948ba653a463d429e02fda2f06a3d6b78666d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65f39d09d73718611cee40399179323b5d4ead00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/66a2179d02668f8df44b1a249899006f3ba38ea0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8cfde7b2fb7288f4f6b90293e8702ff897c682fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/961c717e6bf0e53c2c2b1fe4aef1add9390fedab"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: xfs: fix cursor and pointer handling when recovering iunlink buckets", "id": "2554894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554894"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxfs: fix cursor and pointer handling when recovering iunlink buckets\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n1. We don't null out prev_ip after releasing it, which can lead to UAF\nproblems if the inodegc flush call in the loop fails.\nat which point I noticed even more bugs:\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n3. We set prev_agino to agino having already advanced agino, which\nresults in inodes with i_prev_unlinked set to itself.\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\naliases ip and we also set its i_prev_unlinked to itself.\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\nFix all of these issues.", "A flaw was found in the Linux kernel's XFS file system. Improper pointer handling during the recovery of unlinked files can cause a use-after-free condition, where the operating system attempts to access memory after it has already been freed. A local user capable of mounting a specially crafted file system could exploit this vulnerability during recovery operations, leading to memory corruption or a system crash resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98443", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98443\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98443\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98443.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04755d2e5821b3afbaadd09fe5df58d04de36484,8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04755d2e5821b3afbaadd09fe5df58d04de36484,66a2179d02668f8df44b1a249899006f3ba38ea0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04755d2e5821b3afbaadd09fe5df58d04de36484,961c717e6bf0e53c2c2b1fe4aef1add9390fedab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04755d2e5821b3afbaadd09fe5df58d04de36484,65f39d09d73718611cee40399179323b5d4ead00)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:15:14.548790+00:00", "updated": "2026-10-24T15:30:14.541575+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}