Skip to main content

Linux Kernel CVE-2026-64146

| EUVDEUVD-2026-45831 MEDIUM
Memory Leak (CWE-401)
2026-07-19 Linux GHSA-556c-3r39-wvfx
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access required to reach erofs xattr paths; only availability impacted via kernel resource exhaustion; no data exposed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 19:53 vuln.today
CVSS changed
Aug 17, 2026 - 19:52 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix metabuf leak in inode xattr initialization

commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array.

Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak.

Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.

AnalysisAI

Resource exhaustion in the Linux kernel erofs filesystem driver allows a local low-privileged attacker to leak folio references via error paths in erofs_init_inode_xattrs(), potentially causing kernel memory resource exhaustion or denial of service. Affected systems are those running Linux kernel versions from 5.17 through the fix commits, where erofs filesystems with extended attributes (xattrs) are mounted. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-released patches are available in stable branches targeting 7.0.11 and 7.1.

Technical ContextAI

The erofs (Enhanced Read-Only File System) kernel driver uses on-stack erofs_buf instances for xattr operations following commit bb88e8da0025. In erofs_init_inode_xattrs(), a metabuf is acquired via erofs_read_metabuf() to read the inline xattr header and shared xattr ID array. CWE-401 (Missing Release of Memory after Effective Lifetime) applies: certain error paths that exit through out_unlock fail to call erofs_put_metabuf(), leaving the folio reference held. erofs_put_metabuf() is a no-op when no folio has been acquired, so consolidating cleanup at the out_unlock label is safe and closes all leak-prone paths. Affected CPE is cpe:2.3:a:linux:linux across kernel versions introduced by commit bb88e8da0025 up to the fix commits 492c73b21fef and 79b09c54c656 in respective stable branches.

RemediationAI

The primary fix is upgrading to Linux kernel 7.0.11 or 7.1, which include the corrective commits (https://git.kernel.org/stable/c/492c73b21fefa36f3869cb2b188ffb7fe37b3a9b and https://git.kernel.org/stable/c/79b09c54c6563df9846ca3094bcfd72082c3e1d7). Ubuntu users should apply the patch addressed in USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). As a compensating control where patching is not immediately possible, administrators can prevent exploitation by ensuring erofs filesystems with xattrs are not mounted on multi-user or untrusted-user systems; however, this may not be feasible in Android or container environments relying on erofs. Restricting local user access to affected hosts reduces the exploitable attack surface with no application-layer side effects. Kernel live-patching via kpatch or similar tooling may also be viable for environments requiring uptime continuity.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64146 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy