CVE-2026-97543

Executive Summary

CVE-2026-97543 is a memory-leak defect in the Linux kernel XFS filesystem's online metadata scrub and repair code paths, specifically xchk_dirtree_create_path and xrep_dirtree_create_adoption_path. When the code creates a directory-path object and a subsequent operation to append a name to that path fails, the function returns without destroying the (empty) "seen inode bitmap," leaking kernel memory. The vulnerability requires a privileged, local actor able to invoke XFS online scrub/repair operations (e.g., a CAP_SYS_ADMIN or root-level process) against a mounted XFS filesystem under conditions where path-append failures can be induced; impact is low-severity availability degradation via cumulative kernel memory exhaustion, not code execution or data loss.

Technical Analysis

The affected functionality lives in the XFS kernel subsystem responsible for online metadata checking and repair — the directory-tree ("dirtree") path-reconstruction logic used to relate inodes by directory hierarchy. Two entry points are named in the NVD description: xchk_dirtree_create_path (the scrub/check side) and xrep_dirtree_create_adoption_path (the repair side). Both construct a "directory path object" and then attempt to append a name to that path. Each of these operations is associated with a "seen inode bitmap" — a tracking structure used to record inodes already observed while walking the directory tree, preventing cycles and duplicate traversal.

The defect is an error-path resource-management flaw (CWE-401). The sequence is: (1) allocate/create the dirpath object; (2) allocate/initialize the seen inode bitmap; (3) attempt to append a name to the path; (4) if the append fails, the function returns an error immediately without freeing the seen inode bitmap. The bitmap is described as "empty" at that stage, meaning it holds no user data that could be exfiltrated — the consequence is purely a leaked kernel allocation. The description notes this is "a pretty trivial error" but explicitly frames the omission as leaving "logic bombs," i.e., latent, unreclaimed state that can accumulate or later interact badly with repeated operations.

Attack surface: this is not reachable from unprivileged syscall paths. It requires the ability to run XFS online scrub/repair against a mounted XFS filesystem — a privileged administrative operation. The trigger condition is not an attacker-controlled payload but an induced failure of the path-name-append step. No specific error condition, errno value, corrupted-metadata pattern, or input that reliably forces the append to fail is provided in the available data; accordingly, the precise precondition cannot be stated without fabrication. The description attributes this class of finding to automated analysis (a static/LLM-based code review, "LOLLM"), not to exploitation in the wild.

Because the leak occurs only on the error path, repeated triggering would be required for observable impact. The vulnerability does not by itself corrupt filesystem metadata, does not allow privilege escalation, and does not expose inode contents — the leaked object is an empty bitmap.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (privileged error-path memory leak) and is bounded strictly by the details in the NVD description.

1. Reconnaissance / target identification. An attacker with an existing foothold on a Linux host enumerates mounted filesystems and identifies XFS volumes (hosts exposing XFS data volumes, or systems where XFS is the root/scratch filesystem). Identification is local; there is no meaningful remote fingerprinting step, since the flaw is not network-reachable.

2. Privilege precondition. The attacker must already hold the privileges required to execute XFS online scrub/repair operations (root or equivalent capabilities on the host). This is a post-compromise or malicious-admin scenario, not an initial-access vector. A workload or container that has been granted elevated host-level access could also serve as the trigger origin.

3. Triggering the flaw class. The attacker arranges, or waits for, conditions under which the directory-tree path construction proceeds far enough to allocate the seen inode bitmap but then fails when appending a name to the path. Per the description, that failure path skips destruction of the bitmap. No specific, verified method of forcing the append failure is available in the supplied data, so this step is described only at the class level. Each successful trigger leaks one kernel allocation; the attacker repeats the operation to accumulate the leak.

4. Post-exploitation impact. The observable effect is monotonically increasing kernel memory consumption attributable to unreclaimed seen inode bitmaps. In an extreme case this contributes to memory pressure, degraded performance, or (in combination with other resource exhaustion) availability loss on the affected host. There is no disclosed path from this defect to code execution, privilege escalation, data disclosure, or persistent filesystem corruption. The "logic bomb" framing in the description suggests the concern is defense-in-depth: latent unreclaimed state rather than an immediate high-impact primitive.

Impact Assessment

CVSS 3.1 base score is not assigned (NVD: N/A) and no vector is provided by the source data. The vector shown in METADATA is an analyst-derived estimate for a locally-triggered, high-privilege-required, availability-only kernel memory leak; it is not an official score and should be treated as provisional. EPSS has not been published by FIRST.org, so no probability-of-exploitation figure is available and none is fabricated here.

Business impact is low to moderate and contingent on repeated triggering. Affected systems are Linux hosts running XFS with online metadata scrub/repair available (commonly enterprise storage, database, and backup nodes where XFS is the data filesystem). Blast radius is confined to the local host's kernel memory; the leak does not propagate across the network, does not cross trust boundaries, and does not affect the integrity or confidentiality of stored data. The principal risk is availability degradation under sustained or automated triggering, plus the operational hygiene concern that error paths leave allocations unreclaimed in a subsystem that already handles adversarial metadata.

CISA KEV: No. Exploit code: none. Nuclei template: none.

Detection Guidance

Sigma Rule

title: XFS Online Scrub Directory-Tree Memory Leak Trigger Attempts
id: 8f3c1a2e-5b7d-4c9a-b1e6-7d2f4a9c0e33
status: experimental
description: Detects privileged invocation of XFS online metadata scrub/repair, the precondition for CVE-2026-97543 (seen inode bitmap leak in xchk_dirtree_create_path / xrep_dirtree_create_adoption_path).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97543
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_exec:
    type: EXECVE
    exe|endswith:
      - 'xfs_scrub'
      - 'xfs_scrub_all'
      - 'xfs_repair'
  selection_priv:
    uid: 0
  condition: selection_exec and selection_priv
falsepositives:
  - Legitimate scheduled XFS scrub jobs run by configuration management
level: low
tags:
  - attack.t1499
  - cve.2026.97543

YARA Rule

rule CVE_2026_97543_XFS_Dirtree_Leak_Indicator
{
    meta:
        description = "Detects references to the XFS directory-tree path functions affected by the seen-inode-bitmap leak (CVE-2026-97543) in kernel sources or debug strings"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97543"
        severity = "low"

    strings:
        $fn1 = "xchk_dirtree_create_path" ascii wide
        $fn2 = "xrep_dirtree_create_adoption_path" ascii wide
        $msg = "destroy seen inode bitmap" ascii wide

    condition:
        any of ($fn*) or $msg
}

Suricata IDS Rule

alert tcp any any -> any 2049 (msg:"CVE-2026-97543 XFS dirtree path construction - possible scrub/repair activity against NFS-exported XFS volume"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-recon; sid:202697543; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-97543, confidence low;)

Note: CVE-2026-97543 is not network-exploitable. The rule above is a low-confidence, deployment-specific heuristic only for environments where XFS-backed storage is NFS-exported and scrub activity may correlate with unusual access; it does not detect the leak itself, which is host-local.

Elastic Detection

process where event.type == "start" and
  process.name in ("xfs_scrub", "xfs_scrub_all", "xfs_repair") and
  user.id == "0"

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
(EXECVE OR process_path=*)
(exe=*/xfs_scrub OR exe=*/xfs_scrub_all OR exe=*/xfs_repair)
uid=0
| stats count min(_time) as first_seen max(_time) as last_seen by host, exe, uid
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="linux,xfs,cve-2026-97543,">
  <rule id="100975" level="3">
    <if_sid>80700</if_sid>
    <field name="audit.exe">/xfs_scrub</field>
    <description>CVE-2026-97543: XFS online scrub invoked - precondition for seen-inode-bitmap memory leak</description>
  </rule>
  <rule id="100976" level="3">
    <if_sid>80700</if_sid>
    <field name="audit.exe">/xfs_repair</field>
    <description>CVE-2026-97543: XFS repair invoked - precondition for dirtree adoption-path memory leak</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was supplied with this record; the items below are general hardening measures, not validated remediations.

1. Immediate mitigations

• Restrict execution of XFS online scrub/repair tooling (xfs_scrub, xfs_scrub_all, xfs_repair) to a small set of authorized administrative accounts. Since the flaw is only reachable by a privileged local actor, tightening who can run these commands removes the practical trigger path.
• Audit for unexpected or high-frequency scrub/repair invocations and rate-limit scheduled jobs.
• On hosts where the online repair path is not required, avoid running the repair-mode operations named in the description (xrep_dirtree_create_adoption_path) until a fix is available.
• Monitor kernel memory consumption on XFS-heavy hosts; sustained unexplained growth during scrub windows is the only observable symptom class.

2. Patch / upgrade steps

• Apply the upstream Linux kernel stable/backport update that adds the missing bitmap destruction in both xchk_dirtree_create_path and xrep_dirtree_create_adoption_path as soon as the fixed commits or release versions are confirmed for your kernel line. Because this record carries no patch ID or version, confirm against your distribution's kernel security tracker rather than assuming a version.
• Track your distro vendor's advisory for XFS scrub/repair fixes; vendor backports frequently arrive ahead of upstream release tags.

3. Long-term hardening

• Maintain a strict policy on which processes hold the capability to invoke filesystem scrub/repair, consistent with least privilege.
• Include kernel memory-leak regressions in your validation plan for storage nodes; instrument node-exporter/kernel memory metrics with alerting thresholds tied to XFS maintenance cycles.
• Prefer running scrub/repair during low-load windows so that any accumulated leak is operationally contained, and reboot or drain nodes after large repair jobs until the fix is applied.

References

• NVD — CVE-2026-97543: https://nvd.nist.gov/vuln/detail/CVE-2026-97543
• Linux kernel XFS documentation (online scrub/repair subsystem): https://docs.kernel.org/filesystems/xfs/xfs-online-fsck-design.html
• kernel.org stable release page (source of truth for the eventual fix, once published): https://www.kernel.org/
• CWE-401, Missing Release of Memory after Effective Lifetime: https://cwe.mitre.org/data/definitions/401.html
• CISA Known Exploited Vulnerabilities catalog (status check — CVE-2026-97543 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template have been observed for this CVE. The finding originates from automated code analysis of the XFS subsystem and is currently assessed as low severity with a privileged, local precondition.