CVE-2026-92494

ext4: fix buffer_head leak in ext4_init_orphan_info

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix buffer_head leak in ext4_init_orphan_info

ext4_init_orphan_info() reads orphan file blocks with ext4_bread() and stores the returned buffer_head in oi->of_binfo[i].ob_bh.

If ext4_bread() succeeds but the orphan block magic or checksum validation fails, the function jumps to out_free. However, the old out_free loop starts releasing buffers from i - 1, so the current buffer_head at index i is skipped.

This leaks the buffer_head reference obtained by ext4_bread() on the bad magic and bad checksum error paths.

Fix this by tracking the number of successfully read buffer_heads and releasing exactly those buffer_heads on the error path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before a9a6ec1298f9bc134b2c5db27d25bb10603b7113Affected 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 35fc83c65faf7949f5701bb34b20f822560a7718Affected 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 74637f7fef030e5fb2e835b7dfeb05efdc48e0feAffected 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 6ec53ccab0d691b3c73e03d930343ca45987e88dAffected 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 1399f102d8a1855c1a38506057306ec79d0787d9Affected 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before e1e342d9a561c016b8531ec1f4dcefaad9d64954Affected 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 05704335803b69c1bfa8637b7ada942bf2ee8a41Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before a9a6ec1298f9bc134b2c5db27d25bb10603b7113Affected
02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 35fc83c65faf7949f5701bb34b20f822560a7718Affected
02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 74637f7fef030e5fb2e835b7dfeb05efdc48e0feAffected
02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 6ec53ccab0d691b3c73e03d930343ca45987e88dAffected
02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 1399f102d8a1855c1a38506057306ec79d0787d9Affected
02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before e1e342d9a561c016b8531ec1f4dcefaad9d64954Affected
02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 to before 05704335803b69c1bfa8637b7ada942bf2ee8a41Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.