All vulnerabilities
CVE-2026-98448

Linux: xfs: release orphanage dir inode if chown fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6b66b1a59df6c3f9b4ad9b39a32ca86170ade357Also 6a65a68097a1903988b256d5b367da7b0863a1d5, 1c32cdc986467eaffeedb6c5334852809555b82dCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 6b66b1a59df6c3f9b4ad9b39a32ca86170ade357LinuxCVE List
  • 6a65a68097a1903988b256d5b367da7b0863a1d5LinuxCVE List
  • 1c32cdc986467eaffeedb6c5334852809555b82dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: release orphanage dir inode if chown fails

LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that.

Text from CVE List

Affected versions 10

  • Linuxaffected: 1e58a8ccf2597c9259a8e71a2bffac5e11e12ea0 before 6b66b1a59df6c3f9b4ad9b39a32ca86170ade357CVE List
  • Linuxaffected: 1e58a8ccf2597c9259a8e71a2bffac5e11e12ea0 before 6a65a68097a1903988b256d5b367da7b0863a1d5CVE List
  • Linuxaffected: 1e58a8ccf2597c9259a8e71a2bffac5e11e12ea0 before f813aefd9e09c8cda38a71580b6a01552d97cadeCVE List
  • Linuxaffected: 1e58a8ccf2597c9259a8e71a2bffac5e11e12ea0 before 1c32cdc986467eaffeedb6c5334852809555b82dCVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4