CVE-2026-97543xfs: destroy seen inode bitmap when we fail to add a dirpath
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfs: destroy seen inode bitmap when we fail to add a dirpath LOLLM observes a memory leak in xchk_dirtree_create_path if we create the directory path object but appending the name to the path fails. When this happens, we don't tear down the (empty) seen inode bitmap. This is a pretty trivial error, but let's not leave logic bombs. Do the same for a similar bug in xrep_dirtree_create_adoption_path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 928b721a11789a9363d6d7c32a1f3166a79f3b5f builds before 3b10ca4302ee2dda4233f70b2033883ee376fa6a; 928b721a11789a9363d6d7c32a1f3166a79f3b5f builds before 0b756de8167f2f06ffceadc71cb17c1fc7be4be8; 928b721a11789a9363d6d7c32a1f3166a79f3b5f builds before 582f54dce62043f7a0503ab8c76d718d0293da59; 928b721a11789a9363d6d7c32a1f3166a79f3b5f builds before 1a441c6842da75c5b862cc1c9f7969d6a93b54b9 | CNA record |
References
- https://git.kernel.org/stable/c/3b10ca4302ee2dda4233f70b2033883ee376fa6a
- https://git.kernel.org/stable/c/0b756de8167f2f06ffceadc71cb17c1fc7be4be8
- https://git.kernel.org/stable/c/582f54dce62043f7a0503ab8c76d718d0293da59
- https://git.kernel.org/stable/c/1a441c6842da75c5b862cc1c9f7969d6a93b54b9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.