Improper control of a resource through its lifetime in Linux kernel - CVE-2026-92502
Published: September 18, 2026
Vulnerability identifier: #VU151019
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92502
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause data loss.
The vulnerability exists due to improper clearing of stale xarray tags in ext4 writeback handling when clean folios are skipped during writeback. A local privileged user can trigger writeback during a system reboot to cause data loss.
The issue occurs in ext4 data=journal mode while the superblock is being remounted read-only during reboot.
Affected software
Linux kernel
How to mitigate CVE-2026-92502
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/43ae387c3ae6a11227d096669ddf883e27a39a11
- https://git.kernel.org/stable/c/a450ab88bfd57b227d72c7a3faad54d16c3fc099
- https://git.kernel.org/stable/c/aa0042630b1f7cab735b0a168539281198822586
- https://git.kernel.org/stable/c/ec524aae479b4b2078c47492b90ec21200bce434
- https://git.kernel.org/stable/c/f82a4929d0ef7ddf254c1c295ec1dfd24094f2de