Live › vulnerability › CVE-2026-99051
Go to dashboardA race in the Linux kernel's fs-verity code frees verity metadata while another thread can still look it up under RCU, causing a use-after-free for a different inode. The sources give no severity, and the description does not state what an attacker can obtain beyond a memory-safety fault.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel without the fix that use fs-verity on ext4, f2fs or btrfs are in scope, since the flaw is in how fsverity_info objects are freed. Hosts that never enable fs-verity on any file are less likely to hit the affected path, but the sources do not confirm this. unknown whether any particular configuration is safe to skip.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel release listed by your distribution's advisory for CVE-2026-99051unknown from the sources; look for files enabled with fsverity enable or fsverity measure on your filesystems (ext4, f2fs, btrfs)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
fsverity: RCU-delay the freeing of struct fsverity_info
__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn't directly synchronize with fsverity_remove_info().
For the same inode this isn't a problem: its fsverity_info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity_info and it will no longer be accessed via that inode.
However, this is broken and can cause a use-after-free for concurrent __fsverity_get_info() for different inodes. Those rely on following fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only. They also use fsverity_info::inode to do the key comparison.
Fix this by RCU-delaying the freeing of 'struct fsverity_info' after it's been removed from the rhashtable.
This page as .md · .json · in your agent: get_signal("CVE-2026-99051")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.