Executive brief
A vulnerability in the Linux kernel's file handling system could allow a local user to crash the system or cause a denial of service. By repeatedly triggering a specific error in how the system manages file attributes, an attacker can exhaust the server's memory. This affects the stability and availability of the operating system but does not directly expose private data.
Technical details
A resource leak exists in the fs/xattr.c component of the Linux kernel due to a missing fdput() call in the fremovexattr() error path. When strncpy_from_user() fails on the 'name' argument, the syscall returns early without releasing the file reference acquired via fdget(). In multi-threaded environments, this permanently pins struct file objects in memory. An unprivileged local attacker can exploit this to cause kernel memory exhaustion (CWE-401). The issue was resolved by refactoring the code to use the CLASS(fd) infrastructure, which ensures automatic resource cleanup.
Affected products
- Linux Linux Kernel 6.6.51 to 6.6.133, 6.10.10 to 6.12.77
Timeline
- 2024-11-03: patched: Original fix commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08
- 2026-03-09: disclosed
- 2026-03-09: advisory