Bug 2481931 (CVE-2026-46046) - CVE-2026-46046 kernel: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
Summary: CVE-2026-46046 kernel: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref...
Keywords:
Status: NEW
Alias: CVE-2026-46046
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-27 15:02 UTC by OSIDB Bzimport
Modified: 2026-05-27 19:26 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-27 15:02:57 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()

The commit c8e008b60492 ("ext4: ignore xattrs past end")
introduced a refcount leak in when block_csum is false.

ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to
get iloc.bh, but never releases it with brelse().
Comment 1 Keith Grant 2026-05-27 19:25:24 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052752-CVE-2026-46046-045e@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.