CVE-2026-64146 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure their systems are updated with the latest kernel patches. The vulnerability affects operators, platforms, and security teams that use the Linux kernel. They should review system configurations for erofs usage and monitor system logs for potential issues.

Technical summary

The vulnerability was introduced when erofs_init_inode_xattrs() began using on-stack erofs_buf instances for xattr operations. Some error paths after erofs_read_metabuf() did not properly drop the metabuf, leading to potential folio reference leaks. The issue was resolved by consolidating cleanup at out_unlock, ensuring that erofs_put_metabuf() is called appropriately. However, the exact technical details and affected systems are not clearly stated in the provided sources.

Defensive priority

Medium

Recommended defensive actions

• Update Linux kernel to the latest version
• Review system configurations for erofs usage
• Monitor system logs for potential issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-19T16:17:56.547Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official CVE record. The vulnerability was resolved by consolidating cleanup at out_unlock in the erofs_init_inode_xattrs function. However, the exact impact and affected systems are not clearly stated in the provided sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.