🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-64146 is a memory leak vulnerability in the Linux kernel’s EROFS (Enhanced Read-Only File System) implementation, specifically in the inode extended attribute (xattr) initialisation routine. A metadata buffer is not properly released under certain conditions, which could lead to resource exhaustion or, in some scenarios, expose sensitive data left in unfreed memory. This affects Linux-based Azure workloads, including virtual machines and containerised services running affected kernel versions.
Security Architect’s Take: Review whether your Azure Linux VMs or AKS node pools are running kernel versions affected by this EROFS xattr bug, and prioritise patching through your OS update pipeline or node image upgrades. If EROFS is not in active use, consider whether it can be disabled at the kernel module level as an interim mitigating control.
Original advisory: CVE-2026-64146 erofs: fix metabuf leak in inode xattr initialization