HIGH Introduced in 6.10
xfs Tempfile UAF
CVE-2026-80531
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the XFS online filesystem repair (scrub) subsystem when creating temporary files for metadata reconstruction. If the tempfile creation fails after assigning a pointer to a newly allocated inode but before completing setup, the error path frees the inode without clearing the pointer, leaving a dangling reference that can cause a kernel crash or memory corruption. This issue requires CAP_SYS_ADMIN privileges to trigger via repair operations.
Vulnerability analysis
In the XFS online repair subsystem, the code that creates temporary files for staging reconstructed metadata assigns a pointer to a newly allocated inode early in the process. If a subsequent step in the creation fails, the error handling path correctly unlocks and releases the inode, but it fails to clear the pointer. This leaves a dangling reference that can be accessed later, resulting in a use-after-free condition. The fix adds a single line to nullify the pointer immediately after the inode is released in the error path, preventing any subsequent stale access. This code path is only reachable by a privileged local process holding CAP_SYS_ADMIN that initiates an XFS online repair operation.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.10 | 6.12.105 | 08a20776ce33 |
| 7.1 | 6.10 | 7.1.10 | 96246a3200d3 |
| mainline | 6.10 | 7.2 | 0c88e10d12de |
| 6.18 | 6.10 | 6.18.46 | cd1f876d1bc2 |
| cip/6.12 | 6.10 | 6.12.108-cip31 | 08a20776ce33 |