Executive brief
UBIFS is a file system component used in the Linux kernel. A memory leak occurs when the insert_old_idx() function fails during index node operations, causing allocated memory to be abandoned and never freed. This can result in gradual memory exhaustion on systems using UBIFS, potentially leading to system instability or denial of service.
Technical details
The vulnerability is a memory leak in the UBIFS transaction node cache (TNC) layer. When dirty_cow_znode() calls copy_znode() to allocate a new znode structure and then insert_old_idx() to record the obsoleted index node, a failure in insert_old_idx() causes the function to return an error without freeing the previously allocated znode. The fix refactors copy_znode() and insert_old_idx() into separate allocation and insertion phases, enabling proper resource cleanup in error paths. The vulnerability affects kernel versions from the introduction of UBIFS (Linux 2.6.30 and later) up to versions receiving this patch. Attack requires local access to trigger the affected code path through UBIFS operations.
Affected products
- Linux Linux kernel 2.6.30 through versions before fix (multiple stable branches)
Timeline
- 2025-12-24: disclosed
- 2023: other: Original issue reported in kernel bugzilla #216705