Cloudanix VulnDB

CVE-2026-90318

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of shared file folders on certain storage formats could let an attacker who reaches those folders crash the computer or gain extra control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel FAT driver: fat_rebuild_parent() fails to release sinfo.bh after a successful fat_scan_logstart() for the nostale_ro NFS export path, leaving a buffer head that can be accessed after free once fat_build_inode() consumes the directory entry.

Why it matters to the business

Linux systems exporting FAT volumes over NFS may suffer kernel memory corruption, crashes, or local privilege escalation, disrupting file services and requiring emergency patching on servers or embedded devices.

How an attack unfolds

An attacker with local or NFS access to a FAT volume mounted with nostale_ro triggers the parent inode rebuild path; the unreleased buffer head is later dereferenced after free, enabling memory corruption for denial of service or code execution.

How to fix it

Apply the upstream kernel patch that adds the sinfo.bh release after fat_build_inode() succeeds inside fat_rebuild_parent(); rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Inspect the FAT driver source for the explicit release of sinfo.bh immediately after fat_build_inode() returns in fat_rebuild_parent(); confirm the change is present in the running kernel via source or binary diff.

Typical attack path

  1. Locate a Linux host exporting a FAT filesystem via NFS using the nostale_ro option
  2. Interact with the export to cause directory entry scanning and parent inode rebuild
  3. Trigger the missing buffer-head release to induce use-after-free
  4. Leverage the resulting memory corruption for crash or privilege escalation

How to detect it

Review kernel logs for oops or slab errors referencing FAT buffer heads during NFS parent inode operations; search audit or system logs for unexpected FAT module activity on NFS-mounted volumes.

What your security team should do

  • Prioritize kernel updates on any system exporting FAT over NFS
  • Temporarily disable nostale_ro exports for FAT volumes until patched
  • Add kernel oops and FAT/NFS crash monitoring to detection rules

The record

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fat_scan_logstart() leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fat_scan(). fat_rebuild_parent() uses the directory entry to rebuild the parent inode for the nostale_ro NFS export path, but does not release sinfo.bh after a successful scan. Release it once fat_build_inode() has consumed the directory entry data.

Affected packages

Ecosystem Package Introduced Fixed