{"id":"CVE-2026-98443","kind":"vulnerability","aliases":["CVE-2026-98443"],"related":[],"title":"Linux kernel XFS: recovery of unlinked inodes can leak, loop, or use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n   problems if the inodegc flush call in the loop fails.\n\nat which point I noticed even more bugs:\n\n2. If the inodegc flush inside the loop fails, we also leak @ip.\n\n3. We set prev_agino to agino having already advanced agino, which\n   results in inodes with i_prev_unlinked set to itself.\n\n4. If we exit the bottom of the loop with prev_ip set, then prev_ip\n   aliases ip and we also set its i_prev_unlinked to itself.\n\nBugs 3 and 4 introduce loops into the unlinked list, though these loops\ndon't surface because we immediately flush each unlinked inode after\nloading it.\n\nFix all of these issues.","summary":"The Linux kernel XFS filesystem code that recovers unlinked inode buckets during log recovery mishandles cursor and pointer state, leaving leaked inodes, self-referencing list entries, and a possible use-after-free when an inodegc flush fails. The sources do not say what an attacker can do with it, only that these are kernel memory-safety and consistency bugs.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","other","self-hosted","xfs"],"not_affected_if":["no-xfs-filesystems"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98443 (the xfs unlinked bucket recovery change); the sources do not name a version.","status":"open","published_at":"2026-10-18T16:16:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:30+00:00","updated_at":"2026-10-25T05:27:30+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T05:27:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98443 (the xfs unlinked bucket recovery change); the sources do not name a version.","reach":"local","title":"Linux kernel XFS: recovery of unlinked inodes can leak, loop, or use freed memory","impact":"medium","summary":"The Linux kernel XFS filesystem code that recovers unlinked inode buckets during log recovery mishandles cursor and pointer state, leaving leaked inodes, self-referencing list entries, and a possible use-after-free when an inodegc flush fails. The sources do not say what an attacker can do with it, only that these are kernel memory-safety and consistency bugs.","category":"other","nicknames":[],"who_cares":["linux-kernel","xfs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory possible on failed flush","analyst_note":"Find the upstream kernel commit and the fixed stable versions from the NVD entry, and confirm whether the use-after-free is reachable from unprivileged input.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-xfs-filesystems"],"who_is_affected":"Systems running a Linux kernel with XFS filesystems that replay the log after a crash or unclean mount may hit the unlinked-inode recovery path. The sources do not say which kernel versions are affected or whether a non-XFS system is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3540,"output_tokens":562,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98443':17A,20A '1':121C '2':155C '3':168C,219C '4':190C,221C 'advanc':177C 'agino':172C,174C,178C 'alias':206C 'alreadi':176C 'also':165C,210C 'attack':75B 'bottom':195C 'bucket':39B,110C,120C 'bug':90B,115C,154C,218C 'call':142C 'code':34B 'consist':89B 'cursor':44B,103C 'cve':15A,18A 'entri':55B 'even':152C 'exit':193C 'fail':67B,146C,163C 'filesystem':33B 'fix':102C,244C 'flush':66B,141C,159C,237C 'follow':96C 'free':62B 'freed':13A 'handl':106C 'host':27B 'immedi':236C 'inod':7A,38B,50B,182C,240C 'inodegc':65B,140C,158C 'insid':160C 'introduc':222C 'ip':128C,167C,201C,205C,207C 'issu':248C 'iunlink':109C,119C 'kernel':2A,23B,31B,84B,94C 'lead':134C 'leak':9A,49B,166C 'leav':48B 'linux':1A,22B,30B,93C 'linux-kernel':21B 'list':54B,227C 'load':242C 'log':41B 'lollm':111C 'loop':10A,145C,162C,198C,223C,230C 'memori':14A,86B 'memory-safeti':85B 'mishandl':43B 'notic':151C 'null':125C 'point':112C,149C 'pointer':46B,105C 'possibl':58B 'prev':127C,171C,185C,200C,204C,214C 'problem':137C 'recov':36B,108C,118C 'recoveri':4A,42B 'referenc':53B 'releas':130C 'resolv':100C 'result':180C 'safeti':87B 'say':72B 'self':26B,52B 'self-host':25B 'self-referenc':51B 'set':170C,187C,202C,211C 'sourc':69B 'state':47B 'surfac':233C 'though':228C 'uaf':136C 'unlink':6A,37B,186C,215C,226C,239C 'use':12A,60B 'use-after-fre':59B 'vulner':97C 'xfs':3A,28B,32B,101C 'xlog':117C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with XFS filesystems that replay the log after a crash or unclean mount may hit the unlinked-inode recovery path. The sources do not say which kernel versions are affected or whether a non-XFS system is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98443","severity":null,"published_at":"2026-10-18T16:16:54+00:00","modified_at":"2026-10-21T13:21:29+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}