CVE-2026-23145

What it actually does

Unreleased buffer head reference count in the error path of ext4_xattr_inode_update_ref causes a memory leak of the iloc.bh structure.

Why it matters to the business

Repeated triggering on Linux systems using ext4 can lead to gradual memory exhaustion, potential denial of service, or degraded performance; the large number of downstream Linux distributions increases exposure across server and cloud environments.

How an attack unfolds

A local attacker with low privileges crafts file system operations involving extended attributes on ext4 that force the error branch in ext4_xattr_inode_update_ref, repeatedly leaking buffer head references until memory pressure impacts availability.

How to fix it

Upgrade the Linux kernel to version 5.10.249 or later; for Ubuntu 20.04 LTS on linux-aws-5.15, apply package version 5.15.0-1049.54~20.04.1 or newer. Reboot after kernel updates and verify the running kernel version.

How to confirm the fix worked

Confirm the installed kernel version matches or exceeds the fixed releases; review ext4 source for the reference count release on the error path; test extended attribute operations under error conditions to ensure no leaks occur.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Perform or induce extended attribute operations on an ext4 file system that trigger the error path
3. Repeat the operation to accumulate unreleased buffer head references
4. Monitor or wait for memory exhaustion to affect system stability

How to detect it

Review kernel logs and memory usage patterns for unexpected growth tied to ext4 xattr operations; examine audit logs for repeated extended attribute calls by non-privileged users; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on all ext4-using systems within the next maintenance window
• Monitor EPSS trend and reassess if exploit maturity increases
• Apply updates to linux-aws-5.15 packages on Ubuntu 20.04 LTS immediately due to high downstream prevalence
• Restrict untrusted local user access to ext4 file systems until patched