SECURITY ANNOUNCEMENT

CVE-2026-99080

23 October 2026

syzbot have found ways to force it to happen with madvise. Rather than fix the leaks where they happen, just call xa_destroy() which has the side-effect of cycling the i_pages lock.

Introduced

Unavailable in source

Fixed releases

6.12.11321f51434c47d8628b62275ae6c6ad6b573abcd02

6.18.5750cff3f112d64db6e5f57355f79bc837db8fe132

6.6.160f1c966eb6ed5e190c90a56c5bdaa69967de39f21

7.2.1143f830e2bb84b22ca824b20bb861d823ecb520bd

7.3ee3f011250104129893d8e9599147e457d4d7280

View source announcement ↗