SB2026050619 - Improper resource shutdown or release in Linux kernel ext4
Published: May 6, 2026
Security Bulletin ID
SB2026050619
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper resource shutdown or release (CVE-ID: CVE-2026-43066)
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in ext4_fc_replay_inode() when replaying inode updates during ext4 fast commit recovery. A local user can trigger error paths that leak a buffer head reference to cause a denial of service.
The issue occurs on multiple error paths after obtaining the inode location buffer head.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3
- https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21
- https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03
- https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25
- https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4
- https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b
- https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29
- https://git.kernel.org/stable/c/f7817ad399d604e8639005d87d148b5ec626ad26