CVE-2026-90318: fat: release buffer head after rebuilding parent
In the Linux kernel, the following vulnerability has been resolved:
fat: release buffer head after rebuilding parent
fatscanlogstart() leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan().
fatrebuildparent() uses the directory entry to rebuild the parent inode for the nostalero NFS export path, but does not release sinfo.bh after a successful scan. Release it once fatbuildinode() has consumed the directory entry data.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel FAT filesystem and the nostale_ro NFS export path can reach the affected parent-inode rebuild logic.
Under what condition does the resource leak occur?
The leak occurs after fat_scan_logstart() successfully finds the matching directory entry and fat_rebuild_parent() rebuilds the parent inode without releasing the buffer head retained in sinfo.bh.