---
id: "CVE-2026-98443"
kind: "vulnerability"
aliases: ["CVE-2026-98443"]
title: "Linux kernel XFS: recovery of unlinked inodes can leak, loop, or use freed memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["linux-kernel", "other", "self-hosted", "xfs"]
not_affected_if: ["no-xfs-filesystems"]
published_at: "2026-10-18T16:16:54+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:27:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98443", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel XFS: recovery of unlinked inodes can leak, loop, or use freed memory

The Linux kernel XFS filesystem code that recovers unlinked inode buckets during log recovery mishandles cursor and pointer state, leaving leaked inodes, self-referencing list entries, and a possible use-after-free when an inodegc flush fails. The sources do not say what an attacker can do with it, only that these are kernel memory-safety and consistency bugs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98443 (the xfs unlinked bucket recovery change); the sources do not name a version.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98443

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix cursor and pointer handling when recovering iunlink buckets

LOLLM pointed out a bug in xlog_recover_iunlink_bucket:

1. We don't null out prev_ip after releasing it, which can lead to UAF
   problems if the inodegc flush call in the loop fails.

at which point I noticed even more bugs:

2. If the inodegc flush inside the loop fails, we also leak @ip.

3. We set prev_agino to agino having already advanced agino, which
   results in inodes with i_prev_unlinked set to itself.

4. If we exit the bottom of the loop with prev_ip set, then prev_ip
   aliases ip and we also set its i_prev_unlinked to itself.

Bugs 3 and 4 introduce loops into the unlinked list, though these loops
don't surface because we immediately flush each unlinked inode after
loading it.

Fix all of these issues.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_