CVE-2026-46002: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
ext2: reject inodes with zero inlink and valid mode in ext2iget()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.12.77+ - Configuration
Ensure ext2_iget() rejects inodes that have i_nlink == 0 while i_mode is non-zero (so such inodes are rejected at load time and never reach VFS/WARN_ON in drop_nlink()).
ext2 reject inodes with i_nlink == 0 and valid mode in ext2_iget() = enabled - Configuration
Extend the existing i_nlink == 0 check to also catch the crafted-inode case where i_nlink == 0 with a non-zero i_mode and zero i_dtime; this prevents triggering WARN_ON inside drop_nlink().
VFS/inode management i_nlink == 0 check in inode/rename/unlink paths = extended
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel with ext2 filesystems are exposed when they process a corrupted or crafted ext2 image containing an inode with i_nlink set to zero, a non-zero mode, and zero deletion time. The affected software list also includes Microsoft azl3 kernel 6.6.139.1-1.
What does an attacker need to do to trigger the problem?
The attack requires local access with low privileges and a crafted ext2 filesystem image that presents the invalid inode state to the VFS. The warning can be reached through ext2 unlink, rename, or rmdir operations involving that inode.
How can administrators identify a possible trigger?
A triggered system may log a WARN_ON in drop_nlink() in fs/inode.c. Stack traces can include ext2_unlink(), ext2_rename(), or ext2_rmdir() before reaching drop_nlink().
Can a normally deleted ext2 inode have this state?
No. The described combination of zero link count, valid mode, and zero deletion time is treated as filesystem corruption because legitimate ext2 deletion sets a deletion time or clears the inode mode before freeing the inode.