CVE-2026-46002ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() ext2_iget() already rejects inodes with i_nlink == 0 when i_mode is zero or i_dtime is set, treating them as deleted. However, the case of i_nlink == 0 with a non-zero mode and zero dtime slips through. Since ext2 has no orphan list, such a combination can only result from filesystem corruption - a legitimate inode deletion always sets either i_dtime or clears i_mode before freeing the inode. A crafted image can exploit this gap to present such an inode to the VFS, which then triggers WARN_ON inside drop_nlink() (fs/inode.c) via ext2_unlink(), ext2_rename() and ext2_rmdir(): WARNING: CPU: 3 PID: 609 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336 CPU: 3 UID: 0 PID: 609 Comm: syz-executor Not tainted 6.12.77+ #1 Call Trace: <TASK> inode_dec_link_count include/linux/fs.h:2518 [inline] ext2_unlink+0x26c/0x300 fs/ext2/namei.c:295 vfs_unlink+0x2fc/0x9b0 fs/namei.c:4477 do_unlinkat+0x53e/0x730 fs/namei.c:4541 __x64_sys_unlink+0xc6/0x110 fs/namei.c:4587 do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> WARNING: CPU: 0 PID: 646 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336 CPU: 0 UID: 0 PID: 646 Comm: syz.0.17 Not tainted 6.12.77+ #1 Call Trace: <TASK> inode_dec_link_count include/linux/fs.h:2518 [inline] ext2_rename+0x35e/0x850 fs/ext2/namei.c:374 vfs_rename+0xf2f/0x2060 fs/namei.c:5021 do_renameat2+0xbe2/0xd50 fs/namei.c:5178 __x64_sys_rename+0x7e/0xa0 fs/namei.c:5223 do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> WARNING: CPU: 0 PID: 634 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336 CPU: 0 UID: 0 PID: 634 Comm: syz-executor Not tainted 6.12.77+ #1 Call Trace: <TASK> inode_dec_link_count include/linux/fs.h:2518 [inline] ext2_rmdir+0xca/0x110 fs/ext2/namei.c:311 vfs_rmdir+0x204/0x690 fs/namei.c:4348 do_rmdir+0x372/0x3e0 fs/namei.c:4407 __x64_sys_unlinkat+0xf0/0x130 fs/namei.c:4577 do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Extend the existing i_nlink == 0 check to also catch this case, reporting the corruption via ext2_error() and returning -EFSCORRUPTED. This rejects the inode at load time and prevents it from reaching any of the namei.c paths. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 18 days later
· 18 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 1b80cf48bcf0e1937af9cd6c7beb188762bbf7c5
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 9e2d67fb2b73eeff8b601e26b332128eae8147bb
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < a69a0c5156b6f0092b9fcf44517f5831a962de2d
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 32e0b925572686399243834ec99e2a9d85c62eae
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < d3af04a43db86379df7438bf8bade71685b8a239
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 2dde6377ab2e46bb80cf066c659ef016f3ad7a9b
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 470264bbec499e276a89a6431144ae58f411ea4d
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 25947cc5b2374cd5bf627fe3141496444260d04f
- affected 2.6.12
- unaffected < 2.6.12
- unaffected 5.10.258 – ≤ 5.10.*
- unaffected 5.15.209 – ≤ 5.15.*
- unaffected 6.1.175 – ≤ 6.1.*
- unaffected 6.6.140 – ≤ 6.6.*
- unaffected 6.12.86 – ≤ 6.12.*
- unaffected 6.18.27 – ≤ 6.18.*
- unaffected 7.0.4 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References8
- https://git.kernel.org/stable/c/1b80cf48bcf0e1937af9cd6c7beb188762bbf7c5 (opens in a new tab)
- https://git.kernel.org/stable/c/9e2d67fb2b73eeff8b601e26b332128eae8147bb (opens in a new tab)
- https://git.kernel.org/stable/c/a69a0c5156b6f0092b9fcf44517f5831a962de2d (opens in a new tab)
- https://git.kernel.org/stable/c/32e0b925572686399243834ec99e2a9d85c62eae (opens in a new tab)
- https://git.kernel.org/stable/c/d3af04a43db86379df7438bf8bade71685b8a239 (opens in a new tab)
- https://git.kernel.org/stable/c/2dde6377ab2e46bb80cf066c659ef016f3ad7a9b (opens in a new tab)
- https://git.kernel.org/stable/c/470264bbec499e276a89a6431144ae58f411ea4d (opens in a new tab)
- https://git.kernel.org/stable/c/25947cc5b2374cd5bf627fe3141496444260d04f (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32298 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-46002)Record last updated .