PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43066 Linux CVE debrief

CVE-2026-43066 is a medium-severity (CVSS 3.1: 5.5) memory leak vulnerability in the Linux kernel's ext4 filesystem fast-commit replay logic. The flaw exists in ext4_fc_replay_inode(), where ext4_get_fc_inode_loc() acquires a reference to iloc.bh (a buffer head) that must be released via brelse(). Multiple error paths—including failures in ext4_handle_dirty_metadata(), sync_dirty_buffer(), ext4_mark_inode_used(), and ext4_iget()—incorrectly jump to the 'out' label without releasing this buffer head reference, causing a resource leak. The fix introduces an 'out_brelse' label to ensure iloc.bh is always released before exiting, and also corrects error propagation so the function returns actual error codes instead of always returning 0. This vulnerability affects Linux kernel versions from 5.10 through multiple stable branches up to 7.0-rc5, with patches available for all supported stable releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector with low complexity, requiring low privileges, resulting in high availability impact through potential denial of service from resource exhaustion. The weakness is classified as CWE-401 (Missing Release of Memory after Effective Lifetime).

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-05-29
Advisory published
2026-05-05
Advisory updated
2026-05-29

Who should care

Linux system administrators running ext4 filesystems with fast-commit enabled; kernel maintainers and distributions packaging stable kernel updates; security teams tracking local denial-of-service conditions in filesystem subsystems.

Technical summary

The ext4_fc_replay_inode() function in fs/ext4/fast_commit.c acquires a buffer head via ext4_get_fc_inode_loc() stored in iloc.bh. This buffer head must be released with brelse() to prevent resource leaks. The original code had an 'out' label that skipped brelse(), reachable from four error conditions: ext4_handle_dirty_metadata() failure, sync_dirty_buffer() failure, ext4_mark_inode_used() failure, and ext4_iget() failure. The fix adds an 'out_brelse' label immediately before 'out' so all error paths release iloc.bh, and modifies return values to propagate actual error codes rather than unconditionally returning 0. This is a classic cleanup-path bug with no direct security boundary crossing, but repeated triggering could exhaust buffer head allocations and cause denial of service.

Defensive priority

patch

Recommended defensive actions

  • Apply the appropriate stable kernel patch for your release branch (5.10.253+, 5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, or 7.0-rc6+).
  • If running a vulnerable kernel with ext4 fast-commit enabled, monitor for buffer head exhaustion symptoms (increased memory usage, filesystem slowdowns, or allocation failures in ext4 operations).
  • Consider disabling ext4 fast-commit (tune2fs -O ^fast_commit) as a temporary mitigation if patching is not immediately feasible, though this will disable fast-commit recovery benefits.
  • Validate successful patch application by verifying kernel version matches or exceeds the fixed release for your branch.

Evidence notes

Vulnerability description and patch details sourced from NVD record and kernel.org stable patch commits. Affected version ranges derived from NVD CPE criteria. CVSS 3.1 vector and score from NVD. CWE-401 classification from NVD weakness data. Timeline uses CVE published date (2026-05-05) per supplied metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43066 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43066

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43066 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43066

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.