Description
In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)
References (9)
Core 9
Core References
Scores
CVSS v3
7.8
EPSS
0.0021
EPSS Percentile
10.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-416
Status
published
Products (29)
linux/Kernel
2.6.12 - 4.9.331linux
linux/Kernel
4.10.0 - 4.14.296linux
linux/Kernel
4.15.0 - 4.19.262linux
linux/Kernel
4.20.0 - 5.4.218linux
linux/Kernel
5.11.0 - 5.15.73linux
linux/Kernel
5.16.0 - 5.19.15linux
linux/Kernel
5.20.0 - 6.0.1linux
linux/Kernel
5.5.0 - 5.10.148linux
Linux/Linux
< 2.6.12
Linux/Linux
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 - 1e555c3ed1fce4b278aaebe18a64a934cece57d8
... and 19 more
Published
Sep 17, 2025
Tracked Since
Feb 18, 2026