CVE-2026-64146

commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array.

Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak.

Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64146.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

bb88e8da00253bea0e7f0f4cdfd7910572d7799f

Fixed

89682dd09efb3825b0f162a72e342c52b69ea14a

Fixed

3812cfe6cb0a5988df4fedcdaf9aab677b9cca61

Fixed

e4a552e0b6413c1af2e140b5bc14bb849b411b57

Fixed

fcb23bb31508b62e8a1b32adf6217820e90e29b0

Fixed

492c73b21fefa36f3869cb2b188ffb7fe37b3a9b

Fixed

79b09c54c6563df9846ca3094bcfd72082c3e1d7

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64146.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.17.0

Fixed

6.1.191

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.160

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.114

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.57

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.0.11

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64146.json"