CVE-2026-92494 ext4: fix buffer_head leak in ext4_init_orphan_info
A local attacker can cause a memory leak in the Linux kernel ext4 filesystem, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92494?
CVE-2026-92494 is a memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix buffer_head leak in ext4_init_orphan_info
ext4_init_orphan_info() reads orphan file blocks with ext4_bread() and stores the returned buffer_head in oi->of_binfo[i].ob_bh.
If ext4_bread() succeeds but the orphan block magic or checksum validation fails, the function jumps to out_free. However, the old out_free loop starts releasing buffers from i - 1, so the current buffer_head at index i is skipped.
This leaks the buffer_head reference obtained by ext4_bread() on the bad magic and bad checksum error paths.
Fix this by tracking the number of successfully read buffer_heads and releasing exactly those buffer_heads on the error path.
Which versions are affected by CVE-2026-92494?
How do I fix CVE-2026-92494?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-92494 being exploited?
There is no known exploitation of CVE-2026-92494 in the wild and no public exploit code.
Sources
Also known as AZL-102540, BELL-CVE-2026-92494, DEBIAN-CVE-2026-92494, GHSA-72fx-6p3v-7c2x, UBUNTU-CVE-2026-92494.