Executive brief
A vulnerability in the Linux kernel's handling of FAT file systems could allow a system crash or instability when processing corrupted storage media. By using a specially crafted or damaged FAT image, an attacker or a corrupted disk could trigger an internal error (underflow) when a directory is removed. This primarily impacts system availability and the reliability of data operations on affected drives.
Technical details
A vulnerability exists in the FAT file system implementation (msdos and vfat) of the Linux kernel where corrupted images can cause a directory inode to have an incorrect link count (i_nlink). When 'rmdir' is called, the kernel unconditionally decrements this count via 'drop_nlink()'. If the count is already low due to corruption, it can underflow to zero, triggering a kernel WARN_ON. The fix introduces a sanity check in 'vfat_rmdir()' and 'msdos_rmdir()' to ensure the parent link count is at least 3 before dropping it, otherwise reporting a filesystem error. This is primarily a local denial-of-service or stability issue reachable via malicious or corrupted FAT-formatted media.
Affected products
- Linux Linux Kernel All versions prior to the 2026-01-26 fix (specifically affecting FAT/MSDOS/VFAT file systems)
Timeline
- 2026-01-01: disclosed: Initial patch submission by Zhiyu Zhang
- 2026-01-26: patched: Mainline kernel patch committed by Andrew Morton
- 2026-05-27: advisory: CVE-2026-45915 published
References
- https://git.kernel.org/stable/c/17866f8a0822d414cb02e621cf003a7d04396ef8
- https://git.kernel.org/stable/c/7fe0de287e931e07cb96ecf1f449b2ebdb0e1115
- https://git.kernel.org/stable/c/8cafcb881364af5ef3a8b9fed4db254054033d8a
- https://git.kernel.org/stable/c/955c5d670b5ae07c78f4345e23a895638db96ce1
- https://git.kernel.org/stable/c/9894c79fd9466612d0514be157b5c30cd93aa645
- https://git.kernel.org/stable/c/cd569b87378b9c33ae13c23d6bb9d205d66f7c4b
- https://git.kernel.org/stable/c/d0bb592fa9def2bace90ac8926c0a1d6fa8c1aa0