Executive brief
The Linux kernel's XFS file system contains a use-after-free vulnerability in the online repair code that creates temporary files. If the temporary file creation fails after the inode pointer is set, the kernel may attempt to access a freed memory location, potentially leading to a kernel crash or privilege escalation on systems running affected versions.
Technical details
This is a use-after-free (UAF) vulnerability in the XFS online repair subsystem, specifically in the xrep_tempfile_create function within fs/xfs/scrub/tempfile.c. The root cause is that when temporary file creation fails after the sc->tempip pointer is set, the error handling path does not clear the pointer before releasing the inode. Subsequent code may attempt to dereference the freed inode structure, causing a use-after-free condition. The fix adds a single line (sc->tempip = NULL;) after the xchk_irele call in the error path to prevent subsequent accesses to the freed memory. The vulnerability affects Linux kernel v6.10 and later, with the original defect introduced in commit 84c14ee39dd388. The fix is available in upstream kernel and has been backported to stable branches.
Affected products
- Linux Linux kernel v6.10 and later before patch
Timeline
- 2026-08-26: disclosed
- 2026-07-26: patched: Upstream fix committed
- 2026-08-26: advisory