CVE-2026-99174ext4: free the sbi after a grace period
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT). That reads s_mount_state in the ASSERT() of ext4_getblk() and again in ext4_es_lookup_extent(), and the lookup bumps the extent status hit or miss counter, all through sb->s_fs_info. ext4_put_super() destroys those counters, clears sb->s_fs_info and frees the sbi without waiting for a grace period. A pathwalk that is still in ext4_get_link() when the last reference to the mount goes away then dereferences a NULL s_fs_info, the freed sbi or the destroyed percpu counters. With a pathwalk held up in ext4_get_link() while the last reference goes away: KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:ext4_getblk+0xf0/0x640 Call Trace: <TASK> ext4_get_link+0x26c/0x410 pick_link+0xf96/0x1780 step_into_slowpath+0x9b8/0x1250 path_lookupat+0x484/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. Keep sb->s_fs_info and free the sbi together with the extent status counters after a grace period. Split the counters out of ext4_es_unregister_shrinker() for that. The shrinker still gets wasted in ext4_put_super(), the counters go with the sbi.
Timeline
ID reserved
By Linux
- 33 days later
· 33 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 6493792d3299b3e33f887ef8a150099d271faf9c – < cf3bd5824c985b350d150bcd76698ee5e993fcba
- affected 6493792d3299b3e33f887ef8a150099d271faf9c – < b4b0598fad51a978fcbda9d55eef6b5bd3cbe7d8
- affected 6493792d3299b3e33f887ef8a150099d271faf9c – < 4ce0e27ea610663a9cdc04e3bca38559147428d4
- affected 6493792d3299b3e33f887ef8a150099d271faf9c – < 80d5db1686b05fad6f384be017714297d828a714
- affected 6493792d3299b3e33f887ef8a150099d271faf9c – < 87d29b8b849738d52fe820d495fa0aa2d5a1ec82
- affected 6493792d3299b3e33f887ef8a150099d271faf9c – < c17b44266a1f9fcb49b894d4611d1254bf1aa313
- affected 5.19
- unaffected < 5.19
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/cf3bd5824c985b350d150bcd76698ee5e993fcba (opens in a new tab)
- https://git.kernel.org/stable/c/b4b0598fad51a978fcbda9d55eef6b5bd3cbe7d8 (opens in a new tab)
- https://git.kernel.org/stable/c/4ce0e27ea610663a9cdc04e3bca38559147428d4 (opens in a new tab)
- https://git.kernel.org/stable/c/80d5db1686b05fad6f384be017714297d828a714 (opens in a new tab)
- https://git.kernel.org/stable/c/87d29b8b849738d52fe820d495fa0aa2d5a1ec82 (opens in a new tab)
- https://git.kernel.org/stable/c/c17b44266a1f9fcb49b894d4611d1254bf1aa313 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-111926 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99174)Record last updated .