PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46002 Linux CVE debrief

A vulnerability in the Linux kernel's ext2 filesystem implementation allows corrupted inodes with zero link count but valid mode bits to reach VFS operations, triggering kernel warnings. The flaw exists in ext2_iget(), which failed to reject inodes where i_nlink == 0 with non-zero i_mode and zero i_dtime—a combination that can only result from filesystem corruption. When such inodes are processed through ext2_unlink(), ext2_rename(), or ext2_rmdir(), they invoke drop_nlink() with an already-zero link count, causing WARN_ON assertions. The fix extends existing validation to reject these corrupted inodes at load time with -EFSCORRUPTED, preventing them from reaching namei.c paths. This vulnerability was discovered by the Linux Verification Center using Syzkaller.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators maintaining ext2 filesystems, security teams monitoring for filesystem-based attacks, kernel developers working on filesystem drivers, and organizations running systems that process untrusted filesystem images in sandboxed or virtualized environments.

Technical summary

The ext2_iget() function in the Linux kernel's ext2 filesystem driver contains insufficient validation for corrupted inode states. While it already rejected inodes with i_nlink == 0 when i_mode is zero or i_dtime is set, it failed to handle the case where i_nlink == 0 with valid i_mode and zero i_dtime. Since ext2 lacks an orphan list, this state can only occur through filesystem corruption. A crafted ext2 image can present such inodes to the VFS, which then triggers WARN_ON assertions in drop_nlink() when processed through unlink, rename, or rmdir operations. The vulnerability is addressed by extending the existing validation to reject these inodes at load time with -EFSCORRUPTED.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor kernel logs for ext2 filesystem corruption warnings as indicators of potential exploitation attempts
  • Consider filesystem integrity checks on ext2 volumes that may have been exposed to untrusted images
  • Review systems that process untrusted ext2 filesystem images, particularly in container or virtualization environments

Evidence notes

The CVE description provides kernel stack traces showing WARN_ON triggers in drop_nlink() via three distinct code paths: ext2_unlink() at fs/ext2/namei.c:295, ext2_rename() at fs/ext2/namei.c:374, and ext2_rmdir() at fs/ext2/namei.c:311. The fix involves extending the i_nlink == 0 validation check in ext2_iget() to catch cases where i_mode is non-zero and i_dtime is zero. Multiple stable kernel commits are referenced, indicating backports across supported versions.

Official resources

2026-05-27