CVE-2026-98448

A flaw was found in the Linux kernel's XFS file system. A local user could trigger an error during file system repair operations when changing ownership of an orphanage directory, causing the kernel to fail to release a reference to an inode (a data structure representing a file system object). This reference leak prevents resources from being properly reclaimed, which can lead to memory exhaustion and a denial of service (DoS).

This vulnerability is rated as having a Low impact because exploitation requires local administrative privileges to execute XFS online repair operations on a mounted filesystem. In Red Hat Enterprise Linux environments, online repair and scrub features are restricted to privileged administrators, preventing unprivileged local access. Furthermore, the issue only occurs when changing ownership of an orphanage directory fails during repair, leading to an unreleased inode reference and gradual memory consumption rather than system compromise or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.