Linux Kernel EUVD-2026-103683

Requires local access and the mounting/log-recovery of an XFS filesystem whose log contains unlinked-inode buckets. The use-after-free manifests specifically when the inodegc flush call inside the recovery loop fails, after which prev_ip is left pointing at released memory; the related cursor/pointer bugs also create self-referential (looping) unlinked lists. Limiting factors: the vector is purely local (AV:L) with no remote path, user interaction is required (UI:R) to mount/recover a crafted or corrupt XFS image, and only systems running XFS on affected kernels (6.0 up to the fixed 6.12.113 / 6.18.55 / 7.2.9 / 7.3-rc5 releases) are exposed. The exact conditions under which the inodegc flush fails are not detailed in the available sources, which limits how reliably an attacker can force the UAF versus a benign crash.

This is a local, non-remote memory-safety defect (use-after-free plus unlinked-list corruption) in the XFS log-recovery path of the Linux kernel. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) describes high confidentiality, integrity and availability impact but an attack that is LOCAL and requires user interaction - not network-exploitable. The multi-source signals are consistent and point to a real-but-not-urgent issue: EPSS is only 0.17% (6th percentile), the CVE is NOT on CISA KEV, and the only references are the upstream fix commits on git.kernel.org - there is no public exploit identified and no SSVC/automatable evidence of mass exploitation. The vuln.today decision label is 'this_week', i.e. patch promptly but not an emergency. One tension worth flagging: CVSS sets PR:N (unauthenticated), yet the real trigger is processing/mounting an XFS filesystem and running log recovery, which in most deployments requires some privilege or automount of attacker-supplied media - the CVSS vector likely reflects automount/removable-media scenarios rather than true zero-privilege access, so treat PR:N with caution. The CWE is unspecified in the input, but the commit message confirms this is a use-after-free (CWE-416 class).

A local attacker who can cause an XFS filesystem with a crafted or corrupt log to be mounted and recovered (for example via removable media/automount) triggers recovery of the unlinked-inode buckets; if the inodegc flush inside the recovery loop fails, a dangling pointer (prev_ip not nulled) is dereferenced, producing a use-after-free in kernel context that can corrupt kernel memory, crash the system, or potentially be leveraged toward privilege escalation. No public exploit code was identified - the only references are the upstream fix commits. Exploitation is local and requires user interaction (mount/recovery), consistent with AV:L/UI:R.