CVE-2026-46046

MEDIUM

ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()

Title source: cna
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().

References (8)

Core 8

Scores

CVSS v3 5.5
EPSS 0.0012
EPSS Percentile 2.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (44)
linux/Kernel < 5.10.258linux
linux/Kernel 5.11.0 - 5.15.209linux
linux/Kernel 5.16.0 - 6.1.175linux
linux/Kernel 6.13.0 - 6.18.27linux
linux/Kernel 6.15.0 - 7.0.4linux
linux/Kernel 6.2.0 - 6.6.140linux
linux/Kernel 6.7.0 - 6.12.86linux
Linux/Linux < 6.15
Linux/Linux 362a90cecd36e8a5c415966d0b75b04a0270e4dd - 1bc1107a3a403a6d440673ed6666f7b07ef868a8
Linux/Linux 3bc6317033f365ce578eb6039445fb66162722fd
... and 34 more
Published May 27, 2026
Tracked Since May 27, 2026