CVE-2026-43066 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds a reference to iloc.bh that must be released via brelse(). However, several error paths jump to the 'out' label without releasing iloc.bh: - ext4_handle_dirty_metadata() failure - sync_dirty_buffer() failure - ext4_mark_inode_used() failure - ext4_iget() failure Fix this by introducing an 'out_brelse' label placed just before the existing 'out' label to ensure iloc.bh is always released. Additionally, make ext4_fc_replay_inode() propagate errors properly instead of always returning 0.
A memory leak vulnerability has been identified in the Linux kernel's Ext4 file system, specifically within the fast commit replay functionality. The issue arises in the 'ext4_fc_replay_inode()' function, which fails to properly release a reference to the inode buffer header (iloc.bh) under certain error conditions. This oversight can lead to a resource leak, as the unfreed buffer references accumulate and potentially exhaust system memory.
The vulnerability has been addressed by modifying the 'ext4_fc_replay_inode()' function to ensure that the 'iloc.bh' reference is always released, regardless of how the function exits. This fix is included in the latest version of the Linux kernel.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b | kernel.org | Patch |
| https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f7817ad399d604e8639005d87d148b5ec626ad26 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.10, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.168 >= 6.2, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 5, 2026 | New CVE Received | kernel.org |