Executive brief
A memory leak vulnerability was identified in the Linux kernel's EXT4 file system during the recovery process. This issue occurs when the system attempts to replay file system changes after an unexpected shutdown. If exploited, it could lead to resource exhaustion, potentially causing system instability or a denial of service.
Technical details
A reference count leak (iloc.bh) exists in the ext4_fc_replay_inode() function within fs/ext4/fast_commit.c. The function calls ext4_get_fc_inode_loc(), which increments the reference count on a buffer head, but several error paths (including failures in ext4_handle_dirty_metadata, sync_dirty_buffer, ext4_mark_inode_used, and ext4_iget) jump to a cleanup label that fails to call brelse(). This results in a kernel memory leak during file system recovery. The fix introduces a proper cleanup label to ensure the buffer head is released and ensures error codes are correctly propagated.
Affected products
- Linux Linux Kernel 5.10 to 6.14
Timeline
- 2026-03-23: disclosed: Initial patch submitted by Baokun Li
- 2026-04-02: patched: Merged into various stable kernel branches
- 2026-05-05: advisory: CVE-2026-43066 published
References
- https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3
- https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21
- https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03
- https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25
- https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4
- https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b
- https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29