CVE-2026-99080

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99080", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.390Z", "datePublished": "2026-10-23T12:23:27.393Z", "dateUpdated": "2026-10-30T12:41:35.342Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:35.342Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/inode.c"], "versions": [{"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "3e837269bbfe78a602e0c259d57ffafe7a4df3b2", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "813779d7974e51a6950c7237708853b129d564e1", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "04456642e33022cc53562a91393a09d492124b44", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "21f51434c47d8628b62275ae6c6ad6b573abcd02", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "50cff3f112d64db6e5f57355f79bc837db8fe132", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "43f830e2bb84b22ca824b20bb861d823ecb520bd", "status": "affected", "versionType": "git"}, {"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "lessThan": "ee3f011250104129893d8e9599147e457d4d7280", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/inode.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e837269bbfe78a602e0c259d57ffafe7a4df3b2"}, {"url": "https://git.kernel.org/stable/c/813779d7974e51a6950c7237708853b129d564e1"}, {"url": "https://git.kernel.org/stable/c/04456642e33022cc53562a91393a09d492124b44"}, {"url": "https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21"}, {"url": "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02"}, {"url": "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"}, {"url": "https://git.kernel.org/stable/c/43f830e2bb84b22ca824b20bb861d823ecb520bd"}, {"url": "https://git.kernel.org/stable/c/ee3f011250104129893d8e9599147e457d4d7280"}], "title": "fs: Free any excess xarray nodes in clear_inode()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e837269bbfe78a602e0c259d57ffafe7a4df3b2", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "813779d7974e51a6950c7237708853b129d564e1", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "04456642e33022cc53562a91393a09d492124b44", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "f1c966eb6ed5e190c90a56c5bdaa69967de39f21", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "21f51434c47d8628b62275ae6c6ad6b573abcd02", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "50cff3f112d64db6e5f57355f79bc837db8fe132", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "43f830e2bb84b22ca824b20bb861d823ecb520bd", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}, {"lessThan": "ee3f011250104129893d8e9599147e457d4d7280", "status": "affected", "version": "77da9389b9d5f07d54fda092d1ab56002ec0019a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we've had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock."}], "id": "CVE-2026-99080", "lastModified": "2026-10-30T13:21:43.933", "metrics": {}, "published": "2026-10-23T13:17:32.160", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04456642e33022cc53562a91393a09d492124b44"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e837269bbfe78a602e0c259d57ffafe7a4df3b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43f830e2bb84b22ca824b20bb861d823ecb520bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/813779d7974e51a6950c7237708853b129d564e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee3f011250104129893d8e9599147e457d4d7280"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: fs: Free any excess xarray nodes in clear_inode()", "id": "2559698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559698"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs: Free any excess xarray nodes in clear_inode()\nFor many years we've had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock.", "A flaw was found in the Linux kernel's file system component. When freeing file index records (inodes), the kernel could fail to release unused internal data tracking nodes (xarray nodes) left behind during memory management operations. A local user could exploit this flaw to cause a persistent kernel memory leak, ultimately leading to a Denial of Service (DoS) through system memory exhaustion."], "name": "CVE-2026-99080", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99080\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99080\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99080.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1c966eb6ed5e190c90a56c5bdaa69967de39f21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,21f51434c47d8628b62275ae6c6ad6b573abcd02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,50cff3f112d64db6e5f57355f79bc837db8fe132)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,43f830e2bb84b22ca824b20bb861d823ecb520bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ee3f011250104129893d8e9599147e457d4d7280)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.160)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.113)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1c966eb6ed5e190c90a56c5bdaa69967de39f21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,21f51434c47d8628b62275ae6c6ad6b573abcd02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,50cff3f112d64db6e5f57355f79bc837db8fe132)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,43f830e2bb84b22ca824b20bb861d823ecb520bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ee3f011250104129893d8e9599147e457d4d7280)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.160)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.113)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:45:16.727576+00:00", "updated": "2026-10-27T09:45:06.902525+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-772"]}