Cloudanix VulnDB

CVE-2026-92494

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small memory leak in the Linux ext4 filesystem driver can slowly use up system resources when certain error conditions occur during file-system checks.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Buffer head reference leak in ext4_init_orphan_info when ext4_bread succeeds but subsequent magic or checksum validation fails, causing the current buffer_head at index i to be skipped during error-path cleanup.

Why it matters to the business

Repeated triggering under error conditions can exhaust kernel memory resources on Linux systems using ext4, potentially leading to degraded performance or instability over time in environments with frequent orphan-file operations.

How an attack unfolds

An attacker with the ability to influence ext4 orphan-file block contents (via crafted filesystem images or local access) can cause ext4_bread to return a valid buffer followed by validation failure, leaving the buffer_head unreleased and accumulating memory pressure without direct code execution.

How to fix it

Apply the upstream kernel commit that tracks successfully read buffer_heads and releases exactly those on the error path; rebuild and deploy the patched kernel across affected Linux distributions.

How to confirm the fix worked

Confirm the fix by inspecting the ext4_init_orphan_info implementation to verify that the number of successfully allocated buffer_heads is tracked and released precisely on validation failure paths.

Typical attack path

  1. Mount or access an ext4 filesystem containing a malformed orphan file
  2. Trigger ext4_init_orphan_info during mount or recovery
  3. Force ext4_bread success followed by magic/checksum mismatch
  4. Observe repeated buffer_head leaks on the error path
  5. Accumulate unreleased memory until system impact occurs

How to detect it

Examine kernel memory statistics and slab allocator usage for unexpected growth in buffer_head objects; review dmesg or kernel logs for repeated ext4 orphan-file validation failures during mount or recovery operations.

What your security team should do

  • Prioritize kernel updates on all ext4-using systems within standard patch cycles given low EPSS and absence from KEV
  • Monitor kernel memory usage statistics for anomalous growth correlated with ext4 mount or orphan-file activity
  • Review ext4 filesystem images from untrusted sources before mounting

The record

In the Linux kernel, the following vulnerability has been resolved: ext4: fix buffer_head leak in ext4_init_orphan_info ext4_init_orphan_info() reads orphan file blocks with ext4_bread() and stores the returned buffer_head in oi->of_binfo[i].ob_bh. If ext4_bread() succeeds but the orphan block magic or checksum validation fails, the function jumps to out_free. However, the old out_free loop starts releasing buffers from i - 1, so the current buffer_head at index i is skipped. This leaks the buffer_head reference obtained by ext4_bread() on the bad magic and bad checksum error paths. Fix this by tracking the number of successfully read buffer_heads and releasing exactly those buffer_heads on the error path.

Affected packages

Ecosystem Package Introduced Fixed