CVE-2026-99174

Что произошло

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT). That reads s_mount_state in the ASSERT() of ext4_getblk() and again in ext4_es_lookup_extent(), and the lookup bumps the extent status hit or miss counter, all through sb->s_fs_info. ext4_put_super() destroys those counters, clears sb->s_fs_info and frees the sbi without waiting for a grace period. A pathwalk that is still in ext4_get_link() when the last reference to the mount goes away then dereferences a NULL s_fs_info, the freed sbi or the destroyed percpu counters. With a pathwalk held up in ext4_get_link() while the last reference goes away: KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] RIP: 0010:ext4_getblk+0xf0/0x640 Call Trace: ext4_get_link+0x26c/0x410 pick_link+0xf96/0x1780 step_into_slowpath+0x9b8/0x1250 path_lookupat+0x484/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. Keep sb->s_fs_info and free the sbi together with the extent status counters after a grace period. Split the counters out of ext4_es_unregister_shrinker() for that. The shrinker still gets wasted in ext4_put_super(), the counters go with the sbi.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "6493792d3299b3e33f887ef8a150099d271faf9c",
  "lessThan": "cf3bd5824c985b350d150bcd76698ee5e993fcba",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6493792d3299b3e33f887ef8a150099d271faf9c",
  "lessThan": "b4b0598fad51a978fcbda9d55eef6b5bd3cbe7d8",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6493792d3299b3e33f887ef8a150099d271faf9c",
  "lessThan": "4ce0e27ea610663a9cdc04e3bca38559147428d4",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6493792d3299b3e33f887ef8a150099d271faf9c",
  "lessThan": "80d5db1686b05fad6f384be017714297d828a714",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6493792d3299b3e33f887ef8a150099d271faf9c",
  "lessThan": "87d29b8b849738d52fe820d495fa0aa2d5a1ec82",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6493792d3299b3e33f887ef8a150099d271faf9c",
  "lessThan": "c17b44266a1f9fcb49b894d4611d1254bf1aa313",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "5.19"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "5.19",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "6.1.191",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.161",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.115",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.59",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.13",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-03T21:16:08.004114+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.025683+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.025683+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.025683+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-03T21:16:08.004114+00:00"
  },
  "references": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.025683+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены04.11.2026, 00:16
2. Данные обновлены03.11.2026, 00:15
3. Данные обновлены02.11.2026, 00:13
4. Данные обновлены31.10.2026, 12:00
5. Данные обновлены30.10.2026, 15:58
6. Данные обновлены28.10.2026, 23:51
7. Данные обновлены28.10.2026, 18:00
8. Опубликована28.10.2026, 15:17

Личная заметка и статус

Другие CVE того же продукта