{"id":"CVE-2026-98443","revision":"3a8af5872478498191a9491791da2fa9","records":[{"revision":"3a8af5872478498191a9491791da2fa9","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-98443","aliases":[],"title":"xfs: fix cursor and pointer handling when recovering iunlink buckets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n   problems if the inodegc flush call in the loop fails.\n\nat which point I noticed even more bugs:\n\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n\n3. We set prev_agino to agino having already advanced agino, which\n   results in inodes with i_prev_unlinked set to itself.\n\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\n   aliases ip and we also set its i_prev_unlinked to itself.\n\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\n\nFix all of these issues.","state":0,"publishedAt":"2026-10-18T15:14:53.597+00:00","modifiedAt":"2026-10-24T14:08:51.954+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/xfs_log_recover.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"04755d2e5821b3afbaadd09fe5df58d04de36484\",\n                            \"lessThan\": \"47a948ba653a463d429e02fda2f06a3d6b78666d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"04755d2e5821b3afbaadd09fe5df58d04de36484\",\n                            \"lessThan\": \"8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"04755d2e5821b3afbaadd09fe5df58d04de36484\",\n                            \"lessThan\": \"66a2179d02668f8df44b1a249899006f3ba38ea0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"04755d2e5821b3afbaadd09fe5df58d04de36484\",\n                            \"lessThan\": \"961c717e6bf0e53c2c2b1fe4aef1add9390fedab\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"04755d2e5821b3afbaadd09fe5df58d04de36484\",\n                            \"lessThan\": \"65f39d09d73718611cee40399179323b5d4ead00\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/xfs_log_recover.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/47a948ba653a463d429e02fda2f06a3d6b78666d","https://git.kernel.org/stable/c/8c9d5b8a96d6b93eb24e07b4163c89341ba29bd1","https://git.kernel.org/stable/c/66a2179d02668f8df44b1a249899006f3ba38ea0","https://git.kernel.org/stable/c/961c717e6bf0e53c2c2b1fe4aef1add9390fedab","https://git.kernel.org/stable/c/65f39d09d73718611cee40399179323b5d4ead00"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98443","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98443","identifiers":["CVE-2026-98443"]},"retained":false,"historicalAffected":[]}],"coverage":[]}