CVE-2026-64356

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix memory leak in xfsdqinodemetadir_create()

If xfsmetadircreate() fails in xfsdqinodemetadir_create(), the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is left behind.

Fix this memory leak by routing the create failure path through xfsmetadircancel(). For both create and commit failures, finish and release any inode returned to the caller, mirroring the unwind pattern in xfsmetadirmkdir().

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.

An x8664 allyesconfig build showed no new warnings. Runtime validation used kprobe fault injection during mount -o uquota on a metadir XFS image. Injecting xfsmetadircreate() reproduced the old active-update path that left mount stuck later in mount setup; after this change, the same injection reported cancelhits=1 and irelehits=1. Injecting xfsmetadircommit() exercised the old inode-reference leak path; after this change, it reported irelehits=1.