CVE-2026-46005

xfs: fix a resource leak in xfs_alloc_buftarg()

MEDIUM
5.5
CVSS Score
Published: May 27, 2026 at 12:56 PM UTC
Updated: June 20, 2026 at 03:50 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: fix a resource leak in xfs_alloc_buftarg() In the error path, call fs_put_dax() to drop the DAX device reference.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.0 ≤ v < 6.1.1766.0 ≤ v < 6.12.866.0 ≤ v < 6.18.276.0 ≤ v < 6.6.1406.0 ≤ v < 7.0.46.0 ≤ v < 7.16.13 ≤ v < 6.18.276.19 ≤ v < 7.0.46.7 ≤ v < 6.12.866.06f643c57d57c56d4677bc05f1fca2ef3f249797c
Vendor states this is fixed in 28a6c132b8c6e5eeefa889c4fb43d65b12989d48 (fixed)
Vendor states this is fixed in 29a7b2614357393b176ef06ba5bc3ff5afc8df69 (fixed)
Vendor states this is fixed in 5804cb507233ed767a83ac70527b2f6c4566ec75 (fixed)
Vendor states this is fixed in 5c293a1e1ef0f838772d20ae8afae4cbd87cd3f9 (fixed)
Vendor states this is fixed in 82fb9da6477d08bdab954dc7bc081a41f2f9cae6 (fixed)
Vendor states this is fixed in ed2d6442e61169e565727ba15c4f6a0cb5ce16df (fixed)
Vendor states this is fixed in 6.0 (unaffected)
Vendor states this is fixed in 6.1.176 (unaffected)
Vendor states this is fixed in 6.12.86 (unaffected)
Vendor states this is fixed in 6.18.27 (unaffected)
Vendor states this is fixed in 6.6.140 (unaffected)
Vendor states this is fixed in 7.0.4 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card