CVE-2026-46046 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().
A refcount leak vulnerability has been identified in the ext4 file system of the Linux kernel. This issue arises in the function ext4_xattr_inode_dec_ref_all(), which fails to release a held reference after retrieving inode information. The vulnerability was introduced by a previous commit that altered how extended attributes are processed, leading to the refcount leak when block checksums are disabled.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. The specific commit that addresses this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4.293, < 5.5 >= 5.10.237, < 5.10.258 >= 5.15.181, < 5.15.209 >= 6.1.135, < 6.1.175 >= 6.6.88, < 6.6.140 >= 6.12.24, < 6.12.86 >= 6.13.12, < 6.14 >= 6.14.3, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | kernel.org |
| Sep 8, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |