{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99174 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99174 is a vulnerability in Linux, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99174 and fix it if it is affected.\n\nWhat it is: CVE-2026-99174 is a vulnerability in Linux, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99174 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99174/ (Markdown: https://insights.sbomify.com/CVE-2026-99174/index.md)","id":"CVE-2026-99174","markdown":"https://insights.sbomify.com/CVE-2026-99174/index.md","name":"CVE-2026-99174","record":{"aliases":["AZL-111326","BELL-CVE-2026-99174","DEBIAN-CVE-2026-99174","GHSA-h9fx-4jcw-948x","UBUNTU-CVE-2026-99174"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: free the sbi after a grace period\n\next4_get_link() follows a symlink that keeps its target in a data block\nin rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT).\nThat reads s_mount_state in the ASSERT() of ext4_getblk() and again in\next4_es_lookup_extent(), and the lookup bumps the extent status hit or\nmiss counter, all through sb-\u003es_fs_info.\n\next4_put_super() destroys those counters, clears sb-\u003es_fs_info and frees\nthe sbi without waiting for a grace period. A pathwalk that is still in\next4_get_link() when the last reference to the mount goes away then\ndereferences a NULL s_fs_info, the freed sbi or the destroyed percpu\ncounters.\n\nWith a pathwalk held up in ext4_get_link() while the last reference\ngoes away:\n\n  KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]\n  RIP: 0010:ext4_getblk+0xf0/0x640\n  Call Trace:\n   \u003cTASK\u003e\n   ext4_get_link+0x26c/0x410\n   pick_link+0xf96/0x1780\n   step_into_slowpath+0x9b8/0x1250\n   path_lookupat+0x484/0xb00\n   filename_lookup+0x1f1/0x5b0\n   vfs_statx+0xd7/0x3b0\n   vfs_fstatat+0x4d/0x90\n   __do_sys_newfstatat+0xa0/0x100\n   do_syscall_64+0x10e/0x5e0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSo far that has been hard to hit. umount(2) waits for a grace period in\nnamespace_unlock() before it drops the mount, so only a mount whose last\nreference goes away elsewhere, like the close of a file or a chdir out of\na lazily unmounted directory, can race a walker.\n\nKeep sb-\u003es_fs_info and free the sbi together with the extent status\ncounters after a grace period. Split the counters out of\next4_es_unregister_shrinker() for that. The shrinker still gets wasted\nin ext4_put_super(), the counters go with the sbi.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ext4: free the sbi after a grace period","id":"CVE-2026-99174","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"fsnotify: prevent mark additions during connector teardown","id":"CVE-2026-99175"},"packages":[],"prev":{"headline":"eventfs: Free the eventfs_inode after an rcu grace period too","id":"CVE-2026-99173"},"products":["Linux"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99174/"}