{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92494", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-16T12:21:13.871Z", "datePublished": "2026-09-17T16:10:10.073Z", "dateUpdated": "2026-10-19T09:04:00.500Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:04:00.500Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix buffer_head leak in ext4_init_orphan_info\n\next4_init_orphan_info() reads orphan file blocks with ext4_bread()\nand stores the returned buffer_head in oi->of_binfo[i].ob_bh.\n\nIf ext4_bread() succeeds but the orphan block magic or checksum\nvalidation fails, the function jumps to out_free. However, the old\nout_free loop starts releasing buffers from i - 1, so the current\nbuffer_head at index i is skipped.\n\nThis leaks the buffer_head reference obtained by ext4_bread() on the\nbad magic and bad checksum error paths.\n\nFix this by tracking the number of successfully read buffer_heads and\nreleasing exactly those buffer_heads on the error path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/orphan.c"], "versions": [{"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "a9a6ec1298f9bc134b2c5db27d25bb10603b7113", "status": "affected", "versionType": "git"}, {"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "35fc83c65faf7949f5701bb34b20f822560a7718", "status": "affected", "versionType": "git"}, {"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "74637f7fef030e5fb2e835b7dfeb05efdc48e0fe", "status": "affected", "versionType": "git"}, {"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "6ec53ccab0d691b3c73e03d930343ca45987e88d", "status": "affected", "versionType": "git"}, {"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "1399f102d8a1855c1a38506057306ec79d0787d9", "status": "affected", "versionType": "git"}, {"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "e1e342d9a561c016b8531ec1f4dcefaad9d64954", "status": "affected", "versionType": "git"}, {"version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "lessThan": "05704335803b69c1bfa8637b7ada942bf2ee8a41", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/orphan.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a9a6ec1298f9bc134b2c5db27d25bb10603b7113"}, {"url": "https://git.kernel.org/stable/c/35fc83c65faf7949f5701bb34b20f822560a7718"}, {"url": "https://git.kernel.org/stable/c/74637f7fef030e5fb2e835b7dfeb05efdc48e0fe"}, {"url": "https://git.kernel.org/stable/c/6ec53ccab0d691b3c73e03d930343ca45987e88d"}, {"url": "https://git.kernel.org/stable/c/1399f102d8a1855c1a38506057306ec79d0787d9"}, {"url": "https://git.kernel.org/stable/c/e1e342d9a561c016b8531ec1f4dcefaad9d64954"}, {"url": "https://git.kernel.org/stable/c/05704335803b69c1bfa8637b7ada942bf2ee8a41"}], "title": "ext4: fix buffer_head leak in ext4_init_orphan_info", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ext4/orphan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a9a6ec1298f9bc134b2c5db27d25bb10603b7113", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}, {"lessThan": "35fc83c65faf7949f5701bb34b20f822560a7718", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}, {"lessThan": "74637f7fef030e5fb2e835b7dfeb05efdc48e0fe", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}, {"lessThan": "6ec53ccab0d691b3c73e03d930343ca45987e88d", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}, {"lessThan": "1399f102d8a1855c1a38506057306ec79d0787d9", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}, {"lessThan": "e1e342d9a561c016b8531ec1f4dcefaad9d64954", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}, {"lessThan": "05704335803b69c1bfa8637b7ada942bf2ee8a41", "status": "affected", "version": "02f310fcf47fa9311d6ba2946a8d19e7d7d11f37", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ext4/orphan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix buffer_head leak in ext4_init_orphan_info\n\next4_init_orphan_info() reads orphan file blocks with ext4_bread()\nand stores the returned buffer_head in oi->of_binfo[i].ob_bh.\n\nIf ext4_bread() succeeds but the orphan block magic or checksum\nvalidation fails, the function jumps to out_free. However, the old\nout_free loop starts releasing buffers from i - 1, so the current\nbuffer_head at index i is skipped.\n\nThis leaks the buffer_head reference obtained by ext4_bread() on the\nbad magic and bad checksum error paths.\n\nFix this by tracking the number of successfully read buffer_heads and\nreleasing exactly those buffer_heads on the error path."}], "id": "CVE-2026-92494", "lastModified": "2026-10-19T09:19:39.657", "metrics": {}, "published": "2026-09-17T17:17:51.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05704335803b69c1bfa8637b7ada942bf2ee8a41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1399f102d8a1855c1a38506057306ec79d0787d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35fc83c65faf7949f5701bb34b20f822560a7718"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6ec53ccab0d691b3c73e03d930343ca45987e88d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74637f7fef030e5fb2e835b7dfeb05efdc48e0fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a9a6ec1298f9bc134b2c5db27d25bb10603b7113"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e1e342d9a561c016b8531ec1f4dcefaad9d64954"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ext4: fix buffer_head leak in ext4_init_orphan_info", "id": "2536620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536620"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\next4: fix buffer_head leak in ext4_init_orphan_info\next4_init_orphan_info() reads orphan file blocks with ext4_bread()\nand stores the returned buffer_head in oi->of_binfo[i].ob_bh.\nIf ext4_bread() succeeds but the orphan block magic or checksum\nvalidation fails, the function jumps to out_free. However, the old\nout_free loop starts releasing buffers from i - 1, so the current\nbuffer_head at index i is skipped.\nThis leaks the buffer_head reference obtained by ext4_bread() on the\nbad magic and bad checksum error paths.\nFix this by tracking the number of successfully read buffer_heads and\nreleasing exactly those buffer_heads on the error path.", "A flaw was found in the Linux kernel's ext4 filesystem. When handling orphan file blocks, the system may fail to properly release memory resources if block validation checks fail. This memory leak could lead to resource exhaustion over time, potentially resulting in a Denial of Service (DoS) for the system."], "name": "CVE-2026-92494", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92494\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92494\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-92494.mbox"], "threat_severity": "Low"}