CVE-2026-97545 xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
A local attacker can cause a denial of service by triggering a buffer leak in the XFS filesystem when an IO error occurs during btree block loading.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97545?
CVE-2026-97545 is a memory corruption vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
LOLLM observes that in xfs_btree_bload_prep_block, xfs_btree_bload_drop_buf can hit an IO error if writing the delwri buffer list to disk fails. In this case, we fail to release new_bp, which means we lose a locked buffer. Fix that.
Which versions are affected by CVE-2026-97545?
How do I fix CVE-2026-97545?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-97545 being exploited?
There is no known exploitation of CVE-2026-97545 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97545, DEBIAN-CVE-2026-97545, GHSA-3937-hvp2-9q25, UBUNTU-CVE-2026-97545.