CVE-2026-99051: fsverity: RCU-delay the freeing of struct fsverity_info
In the Linux kernel, the following vulnerability has been resolved:
fsverity: RCU-delay the freeing of struct fsverityinfo
fsveritygetinfo() calls rhashtablelookupfast(), which just uses rcureadlock() and doesn't directly synchronize with fsverityremoveinfo().
For the same inode this isn't a problem: its fsverityinfo is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverityinfo and it will no longer be accessed via that inode.
However, this is broken and can cause a use-after-free for concurrent fsveritygetinfo() for different inodes. Those rely on following fsverityinfo::rhashhead in the rhashtable under rcureadlock() only. They also use fsverityinfo::inode to do the key comparison.
Fix this by RCU-delaying the freeing of 'struct fsverityinfo' after it's been removed from the rhashtable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
RCU-delay freeing of struct fsverity_info until after it has been removed from the rhashtable and is no longer accessible through the inode, preventing concurrent use-after-free.