EUVD-2026-66446
GHSA-2jf4-529g-mpwh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Triggering the post-assignment failure branch in xrep_tempfile_create requires engineering a specific error condition, raising AC to H over the vendor-assigned AC:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
xfs: avoid UAF on sc->tempip in xrep_tempfile_create
LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.
AnalysisAI
Use-After-Free in the XFS filesystem online repair subsystem of the Linux kernel allows a local low-privileged user to potentially achieve full kernel memory corruption and privilege escalation to root. The flaw in xrep_tempfile_create leaves sc->tempip as a dangling pointer when tempfile creation fails partway through, enabling subsequent dereference of freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated session with at least low-privilege credentials (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a credible local privilege escalation path accessible to any low-privilege user, with full confidentiality, integrity, and availability impact upon successful exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a standard unprivileged shell on an XFS-backed Linux system invokes or triggers the XFS online repair scrub path, causing `xrep_tempfile_create` to fail after `sc->tempip` has been assigned. The attacker then times a memory allocation to reclaim the freed inode slab region and uses the dangling `sc->tempip` pointer - when subsequently dereferenced by kernel repair code - to corrupt kernel memory structures, enabling privilege escalation to root. … |
| Remediation | The primary fix is to upgrade to a patched kernel version: 6.12.105, 6.18.46, 7.1.10, or 7.2, as published in the Linux stable tree (see https://git.kernel.org/stable/c/96246a3200d32a43766152e56bc7ae2d93604d74). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an inventory of all Linux systems running XFS filesystems and assess patch deployment readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today