CVE-2026-43066

Vulnerability

Description The vulnerability is a resource leak in the Linux kernel's ext4 file system. In the function ext4_fc_replay_inode(), used during fast commit replay, a replay, the function ext4_get_fc_inode_loc() is called to obtain the inode location and holds a reference to iloc.bh (a buffer head). This reference must be explicitly released via brelse(). However, multiple error paths within the function jump to the 'out' label without first releasing iloc.bh, resulting in a buffer head leak [1].

Exploitability

An attacker with the ability to trigger a fast commit replay and induce failures in one of the following operations could exploit the leak: ext4_handle_dirty_metadata() failure, sync_dirty_buffer() failure, ext4_mark_inode_used() failure, or ext4_iget() failure [2]. The vulnerability is triggered during normal filesystem recovery or mount operations, so a local user or attacker with capabilities to cause the filesystem to go through a fast commit replay (e.g., by issuing a crash and reboot) could repeatedly trigger the leak.

Impact

A repeated failure to release iloc.bh would cause a gradual depletion of kernel memory buffers. Over time, this could lead to memory exhaustion on the system, potentially causing denial of service or system instability. Additionally, the function was returning 0 (success) even on error paths, so no error was propagated to the caller, which could mask ongoing problems [3].

Mitigation

The patch introduces a new label 'out_brelse' before the existing 'out' label to ensure brelse() is always called before exiting. Additionally, the function now properly propagates error codes instead of always returning zero [4]. The fix has been applied to the Linux stable tree and is included in several stable kernel releases