CVE-2026-99080 (GCVE-0-2026-99080)
Vulnerability from cvelistv5
Published
2026-10-23 12:23
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs: Free any excess xarray nodes in clear_inode()
For many years we've had a hard to hit leak of xarray nodes. Hugh
documented it well in commit 786b31121a2c. Recently people and
syzbot have found ways to force it to happen with madvise. Rather
than fix the leaks where they happen, just call xa_destroy() which
has the side-effect of cycling the i_pages lock.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a Version: 77da9389b9d5f07d54fda092d1ab56002ec0019a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e837269bbfe78a602e0c259d57ffafe7a4df3b2",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "813779d7974e51a6950c7237708853b129d564e1",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "04456642e33022cc53562a91393a09d492124b44",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "f1c966eb6ed5e190c90a56c5bdaa69967de39f21",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "21f51434c47d8628b62275ae6c6ad6b573abcd02",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "50cff3f112d64db6e5f57355f79bc837db8fe132",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "43f830e2bb84b22ca824b20bb861d823ecb520bd",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "ee3f011250104129893d8e9599147e457d4d7280",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we\u0027ve had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:35.342Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e837269bbfe78a602e0c259d57ffafe7a4df3b2"
},
{
"url": "https://git.kernel.org/stable/c/813779d7974e51a6950c7237708853b129d564e1"
},
{
"url": "https://git.kernel.org/stable/c/04456642e33022cc53562a91393a09d492124b44"
},
{
"url": "https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21"
},
{
"url": "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02"
},
{
"url": "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"
},
{
"url": "https://git.kernel.org/stable/c/43f830e2bb84b22ca824b20bb861d823ecb520bd"
},
{
"url": "https://git.kernel.org/stable/c/ee3f011250104129893d8e9599147e457d4d7280"
}
],
"title": "fs: Free any excess xarray nodes in clear_inode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99080",
"datePublished": "2026-10-23T12:23:27.393Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-30T12:41:35.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…