ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-46046
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-27 14:17:24 UTC
Updated2026-06-16 13:07:42 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.000320000 probability, percentile 0.097350000 (date 2026-06-04)

Problem Types: NVD-CWE-noinfo

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3 dd98a5603a212ea9c96c6982ccdbcc748fdb9a56 git Not specified
CNA Linux Linux affected f737418b6de31c962c7192777ee4018906975383 153ab2c52355fbebcae622db8e7b506492c73a29 git Not specified
CNA Linux Linux affected cf9291a3449b04688b81e32621e88de8f4314b54 b706d00206a9e82362a9633efbd8b5775650169b git Not specified
CNA Linux Linux affected 362a90cecd36e8a5c415966d0b75b04a0270e4dd 1bc1107a3a403a6d440673ed6666f7b07ef868a8 git Not specified
CNA Linux Linux affected eb59cc31b6ea076021d14b04e7faab1636b87d0e 097227f1ffe1a85bc3c359f81c71e3d40e06e920 git Not specified
CNA Linux Linux affected c8e008b60492cf6fd31ef127aea6d02fd3d314cd 1e6b0a69bf2c9c819255c7566e4355536d81d9cf git Not specified
CNA Linux Linux affected c8e008b60492cf6fd31ef127aea6d02fd3d314cd f072906688933bf47fabbaf63560be03357c8298 git Not specified
CNA Linux Linux affected c8e008b60492cf6fd31ef127aea6d02fd3d314cd 77d059519382bd66283e6a4e83ee186e87e7708f git Not specified
CNA Linux Linux affected 6aff941cb0f7d0c897c3698ad2e30672709135e3 git Not specified
CNA Linux Linux affected 3bc6317033f365ce578eb6039445fb66162722fd git Not specified
CNA Linux Linux affected 836e625b03a666cf93ff5be328c8cb30336db872 git Not specified
CNA Linux Linux affected 5.10.237 5.10.258 semver Not specified
CNA Linux Linux affected 5.15.181 5.15.209 semver Not specified
CNA Linux Linux affected 6.1.135 6.1.175 semver Not specified
CNA Linux Linux affected 6.6.88 6.6.140 semver Not specified
CNA Linux Linux affected 6.12.24 6.12.86 semver Not specified
CNA Linux Linux affected 5.4.293 5.5 semver Not specified
CNA Linux Linux affected 6.13.12 6.14 semver Not specified
CNA Linux Linux affected 6.14.3 6.15 semver Not specified
CNA Linux Linux affected 6.15 Not specified
CNA Linux Linux unaffected 6.15 semver Not specified
CNA Linux Linux unaffected 5.10.258 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.209 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.175 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.140 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.86 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.27 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.4 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/1e6b0a69bf2c9c819255c7566e4355536d81d9cf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/1bc1107a3a403a6d440673ed6666f7b07ef868a8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/097227f1ffe1a85bc3c359f81c71e3d40e06e920 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/153ab2c52355fbebcae622db8e7b506492c73a29 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/f072906688933bf47fabbaf63560be03357c8298 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/77d059519382bd66283e6a4e83ee186e87e7708f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/dd98a5603a212ea9c96c6982ccdbcc748fdb9a56 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/b706d00206a9e82362a9633efbd8b5775650169b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report