CVE-2026-46002: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
Published May 27, 2026
·Updated
ext2: reject inodes with zero inlink and valid mode in ext2iget()
Affected Software
14 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=2.6.12.1<5.10.258
Linux Linux kernel>=5.11<5.15.209
Linux Linux kernel>=5.16<6.1.175
Linux Linux kernel>=6.2<6.6.140
Linux Linux kernel>=6.7<6.12.86
Linux Linux kernel>=6.13<6.18.27
Linux Linux kernel>=6.19<7.0.4
Linux Linux kernel=2.6.12
Linux Linux kernel=2.6.12-rc2
Linux Linux kernel=2.6.12-rc3
Linux Linux kernel=2.6.12-rc4
Linux Linux kernel=2.6.12-rc5
Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1
6.6.141.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.12.77+ - Configuration
Ensure ext2_iget() rejects inodes that have i_nlink == 0 while i_mode is non-zero (so such inodes are rejected at load time and never reach VFS/WARN_ON in drop_nlink()).
ext2 reject inodes with i_nlink == 0 and valid mode in ext2_iget() = enabled - Configuration
Extend the existing i_nlink == 0 check to also catch the crafted-inode case where i_nlink == 0 with a non-zero i_mode and zero i_dtime; this prevents triggering WARN_ON inside drop_nlink().
VFS/inode management i_nlink == 0 check in inode/rename/unlink paths = extended
Event History
May 27, 2026
CVE Published
via MITRE·12:55 PM
Data Sourced
via MITRE·12:55 PM
Description
Data Sourced
via NVD·02:17 PM
RemedyDescriptionSeverityAffected Software
May 28, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:01 AM
Affected Software
Updated
via Microsoft·08:01 AM
DescriptionSeverity