{"id":"CVE-2026-98445","kind":"vulnerability","aliases":["CVE-2026-98445"],"related":[],"title":"Linux kernel XFS: memory allocation failure leaks blocks during online repair","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't let memory failures leak blocks and kill repairs\n\nLOLLM complains that a memory allocation failure in\nxrep_newbt_add_blocks results in online repair leaking blocks that were\npreviously allocated to write a new btree, but the problem is worse than\nthat -- a limitation of the codebase is that the callers cannot undo the\ntransaction /and/ return the error -- either you undo all changes and\ncommit the transaction, or you error out and the filesystem goes down.\n\nHowever, the new btree space reservation object isn't that big (~48\nbytes).  Let's just do a NOFAIL allocation and the problem goes away.","summary":"In the Linux kernel's XFS filesystem, an out-of-memory failure during online repair could leak blocks that were allocated for a new btree, and could force the filesystem to go down. The fix makes that small allocation non-failing, so the leak and the forced shutdown no longer occur.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted","xfs"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:16:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:28+00:00","updated_at":"2026-10-25T05:27:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:27:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel XFS: memory allocation failure leaks blocks during online repair","impact":"low","summary":"In the Linux kernel's XFS filesystem, an out-of-memory failure during online repair could leak blocks that were allocated for a new btree, and could force the filesystem to go down. The fix makes that small allocation non-failing, so the leak and the forced shutdown no longer occur.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","xfs","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Filesystem space leaks and XFS goes down after memory pressure","analyst_note":"Find the kernel commit or stable backport list for CVE-2026-98445 to confirm affected kernel versions and fixed releases.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000531,"input_tokens":3439,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98445':14A,17A '/and':147C '48':180C 'add':110C 'alloc':5A,47B,65B,105C,121C,188C 'away':193C 'big':179C 'block':8A,44B,96C,111C,117C 'btree':51B,126C,172C 'byte':181C 'caller':142C 'cannot':143C 'chang':155C 'codebas':138C 'commit':157C 'complain':101C 'could':42B,53B 'cve':12A,15A 'either':151C 'error':150C,162C 'fail':68B 'failur':6A,38B,94C,106C 'filesystem':32B,56B,166C 'fix':61B 'follow':84C 'forc':54B,74B 'go':58B 'goe':167C,192C 'host':24B 'howev':169C 'isn':176C 'kernel':2A,20B,29B,82C 'kill':98C 'leak':7A,43B,71B,95C,116C 'let':92C,182C 'limit':135C 'linux':1A,19B,28B,81C 'linux-kernel':18B 'lollm':100C 'longer':77B 'make':62B 'memori':4A,37B,93C,104C 'new':50B,125C,171C 'newbt':109C 'nofail':187C 'non':67B 'non-fail':66B 'object':175C 'occur':78B 'onlin':10A,40B,114C 'out-of-memori':34B 'previous':120C 'problem':129C,191C 'repair':11A,41B,99C,115C 'reserv':174C 'resolv':88C 'result':112C 'return':148C 'runtim':21B 'self':23B 'self-host':22B 'shutdown':75B 'small':64B 'space':173C 'transact':146C,159C 'undo':144C,153C 'vulner':85C 'wors':131C 'write':123C 'xfs':3A,25B,31B,89C 'xrep':108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98445","severity":null,"published_at":"2026-10-18T16:16:54+00:00","modified_at":"2026-10-19T10:18:53+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}