CVE-2026-46046
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel related to the missing brelse() call in the ext4_xattr_inode_dec_ref_all() function. The commit c8e008b60492 introduced a refcount leak when block_csum is false.
Risk Assessment
Failure to release resources may lead to memory leaks, which can affect system stability and the performance of applications running on this kernel over time.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability and prevent potential performance issues.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().