CVE-2026-46046

Published: May 27, 2026Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().

Affected (9)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 5.10.237 to 5.10.258
Linux Linux Kernel	From 5.15.181 to 5.15.209
Linux Linux Kernel	From 5.4.293 to 5.5
Linux Linux Kernel	From 6.1.135 to 6.1.175
Linux Linux Kernel	From 6.12.24 to 6.12.86
Linux Linux Kernel	From 6.13.12 to 6.14
Linux Linux Kernel	From 6.14.3 to 6.18.27
Linux Linux Kernel	From 6.19 to 7.0.4
Linux Linux Kernel	From 6.6.88 to 6.6.140