CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs
A memory allocation failure in XFS online repair can leak blocks and crash the filesystem, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98445?
CVE-2026-98445 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't let memory failures leak blocks and kill repairs
LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking blocks that were previously allocated to write a new btree, but the problem is worse than that -- a limitation of the codebase is that the callers cannot undo the transaction /and/ return the error -- either you undo all changes and commit the transaction, or you error out and the filesystem goes down.
However, the new btree space reservation object isn't that big (~48 bytes). Let's just do a NOFAIL allocation and the problem goes away.
Which versions are affected by CVE-2026-98445?
How do I fix CVE-2026-98445?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98445 being exploited?
There is no known exploitation of CVE-2026-98445 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98445, DEBIAN-CVE-2026-98445, GHSA-vx8f-phpg-5qwp, UBUNTU-CVE-2026-98445.