Use-after-free in Linux kernel - CVE-2026-90320
Published: September 18, 2026
Vulnerability identifier: #VU151171
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90320
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper validation of external extended attribute entry bounds in OCFS2 extended attribute metadata handling when listxattr() or getxattr() processes corrupted external xattr metadata. A local user can invoke listxattr() or getxattr() on a filesystem containing corrupted external xattr metadata to cause a denial of service.
The issue affects both non-indexed external extended attribute blocks and indexed extended attribute buckets.
Affected software
Linux kernel
How to mitigate CVE-2026-90320
Install security update from vendor's repository.