What is CVE-2026-99080?

CVE-2026-99080 is a unscored severity Linux kernel vulnerability. CVE-2026-99080 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-99080?

CVE-2026-99080 has a CVSS score of pending NVD analysis out of 10, rated awaiting scoring severity.

Is there a patch available for CVE-2026-99080?

Yes, CVE-2026-99080 has been patched. Fixed versions include 6.6.160, 6.12.113, 6.18.57 and others.

Is CVE-2026-99080 actively exploited?

CVE-2026-99080 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-99080

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with madvise. Rather than fix the leaks where they happen, just call xa_destroy() which has the side-effect of cycling the i_pages lock.

Package Linux Kernel

Published 2026-10-23

Last modified 2026-10-23

Patch available

Yes

Affected versions

Fixed in 6.6.160, 6.12.113, 6.18.57, 7.2.11, 7.3 and their respective stable series.

Fixed in

✓ 6.6.160 6.6.x ✓ 6.12.113 6.12.x ✓ 6.18.57 6.18.x ✓ 7.2.11 7.2.x ✓ 7.3

References

5 total

Frequently asked questions

What is CVE-2026-99080?

CVE-2026-99080 is a unscored severity Linux kernel vulnerability . CVE-2026-99080 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
Is there a patch available for CVE-2026-99080?

Yes. CVE-2026-99080 has been patched. Fixed versions include 6.6.160, 6.12.113, 6.18.57 and others.
Is CVE-2026-99080 actively exploited?

No. CVE-2026-99080 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.