CVE-2026-46046

ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()

MEDIUM

5.5

CVSS Score

Published: May 27, 2026 at 12:57 PM UTC

Updated: October 15, 2026 at 02:19 AM UTC

4 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

All versions5.10.237 ≤ v < 5.10.2585.15.181 ≤ v < 5.15.2095.4.293 ≤ v < 5.56.1.135 ≤ v < 6.1.1756.12.24 ≤ v < 6.12.866.13.12 ≤ v < 6.146.14.3 ≤ v < 6.18.276.19 ≤ v < 7.0.46.6.88 ≤ v < 6.6.140362a90cecd36e8a5c415966d0b75b04a0270e4dd3bc6317033f365ce578eb6039445fb66162722fd5.10.237 5.15.181 5.4.293 6.1.135 6.12.24 6.13.12 6.14.3 6.15 6.6.886aff941cb0f7d0c897c3698ad2e30672709135e376c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3836e625b03a666cf93ff5be328c8cb30336db872c8e008b60492cf6fd31ef127aea6d02fd3d314cdcf9291a3449b04688b81e32621e88de8f4314b54eb59cc31b6ea076021d14b04e7faab1636b87d0ef737418b6de31c962c7192777ee4018906975383

Vendor states this is fixed in 097227f1ffe1a85bc3c359f81c71e3d40e06e920 (fixed)

Vendor states this is fixed in 153ab2c52355fbebcae622db8e7b506492c73a29 (fixed)

Vendor states this is fixed in 1bc1107a3a403a6d440673ed6666f7b07ef868a8 (fixed)

Vendor states this is fixed in 1e6b0a69bf2c9c819255c7566e4355536d81d9cf (fixed)

Vendor states this is fixed in 77d059519382bd66283e6a4e83ee186e87e7708f (fixed)

Vendor states this is fixed in b706d00206a9e82362a9633efbd8b5775650169b (fixed)

Vendor states this is fixed in dd98a5603a212ea9c96c6982ccdbcc748fdb9a56 (fixed)

Vendor states this is fixed in f072906688933bf47fabbaf63560be03357c8298 (fixed)

Vendor states this is fixed in 5.10.258 (unaffected)

Vendor states this is fixed in 5.15.209 (unaffected)

Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.1.175 (unaffected)