CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
ext4: fix missing brelse() in ext4xattrinodedecrefall()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernel ext4to a version that resolves this vulnerability.Patch c8e008b60492 - Compensating control
If you cannot patch immediately, mitigate by reducing exposure to ext4 xattr code paths on affected systems (e.g., limit use of extended attributes where possible) until the kernel commit c8e008b60492 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46046?
CVE-2026-46046 has a medium severity rating of 5.5.
How do I fix CVE-2026-46046?
To fix CVE-2026-46046, upgrade to the latest version of the Linux kernel where the vulnerability has been patched.
What components are affected by CVE-2026-46046?
CVE-2026-46046 affects the ext4 filesystem in the Linux kernel.
What is the nature of the vulnerability identified in CVE-2026-46046?
CVE-2026-46046 is caused by a missing brelse() call in the ext4_xattr_inode_dec_ref_all() function, leading to a reference count leak.
Is CVE-2026-46046 exploitable remotely?
CVE-2026-46046 is considered to have low attack vector exposure, requiring local access for exploitation.