Description

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:07.140Z",
  "pubdate": "2026-08-26T15:17:07.140Z",
  "executiveSummary": "This vulnerability involves a Use-After-Free (UAF) condition within the Linux kernel's XFS filesystem repair mechanisms, specifically affecting the xrep_tempfile_create function.\nThe flaw manifests when a failure occurs during the temporary file creation process after the sc->tempip structure has already been initialized.\nIf the kernel prematurely terminates the operation without properly handling the state of the tempip pointer, subsequent access to this memory location results in a UAF.\nThis vulnerability poses a significant risk to system stability and integrity, potentially allowing for arbitrary code execution, kernel panics, or privilege escalation if an attacker can manipulate the state of the affected memory region.\nThe vulnerability is localized to the XFS repair logic within the Linux kernel.\nExploitation requires local access to the system with sufficient privileges to trigger the XFS repair processes, making it a critical concern for privileged users or attackers attempting to exploit filesystem maintenance routines.",
  "technicalDetails": "The root cause of the vulnerability resides in the error handling logic of xrep_tempfile_create within the XFS filesystem driver of the Linux kernel. During the creation of a temporary file intended for repair operations, the sc->tempip (the temporary inode pointer) is initialized. If the subsequent execution flow encounters an error—such as a failure in resource allocation or filesystem object state validation—the function must ensure that sc->tempip is handled appropriately before exit.\nIn the vulnerable state, if an error path is triggered after the successful assignment of sc->tempip, the kernel may fail to nullify or properly release the reference to the inode, leaving a dangling pointer within the sc (scrub context) structure. Because the kernel memory manager may reallocate the memory formerly occupied by the temporary inode, any later access to sc->tempip will reference this reallocated and potentially modified memory.\nThe attack flow involves triggering a filesystem repair operation on an XFS partition. An attacker who can influence filesystem states or provoke error conditions within the repair utility can force the execution path into the vulnerable error-handling branch. By timing this event precisely, an attacker may be able to influence the kernel heap allocator to place controlled data into the memory region previously occupied by the tempip structure.\nWhen the kernel later attempts to utilize sc->tempip—expecting a valid XFS inode structure—it will instead operate on attacker-controlled data. This leads to arbitrary pointer dereferencing or the execution of forged function pointers if the inode-related operations are invoked. Given that this occurs within the kernel context, the impact is severe, potentially resulting in kernel-mode code execution or a system crash due to invalid memory access patterns.\nThe vulnerability highlights a breakdown in state machine management during error recovery in kernel-space resource initialization. Because the repair context (sc) persists for the duration of the scrub operation, the dangling reference remains active until the context is destroyed, widening the window of opportunity for exploitation."
}