{"id":"CVE-2026-99051","kind":"vulnerability","aliases":["CVE-2026-99051"],"related":[],"title":"Linux kernel: fs-verity lookup can read freed memory across inodes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: RCU-delay the freeing of struct fsverity_info\n\n__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses\nrcu_read_lock() and doesn't directly synchronize with\nfsverity_remove_info().\n\nFor the same inode this isn't a problem: its fsverity_info is removed\nonly at inode eviction time or upon failure to enable verity, when the\ninode no longer needs its fsverity_info and it will no longer be\naccessed via that inode.\n\nHowever, this is broken and can cause a use-after-free for concurrent\n__fsverity_get_info() for *different* inodes.  Those rely on following\nfsverity_info::rhash_head in the rhashtable under rcu_read_lock() only.\nThey also use fsverity_info::inode to do the key comparison.\n\nFix this by RCU-delaying the freeing of 'struct fsverity_info' after\nit's been removed from the rhashtable.","summary":"A race in the Linux kernel's fs-verity code frees verity metadata while another thread can still look it up under RCU, causing a use-after-free for a different inode. The sources give no severity, and the description does not state what an attacker can obtain beyond a memory-safety fault.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fs-verity","kernel","linux","runtime","self-hosted"],"not_affected_if":["no-fsverity-use"],"how_to_check":"- `uname -r` and compare against the fixed kernel release listed by your distribution's advisory for CVE-2026-99051\n- Check whether fs-verity is in use: `unknown` from the sources; look for files enabled with `fsverity enable` or `fsverity measure` on your filesystems (ext4, f2fs, btrfs)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'fsverity: RCU-delay the freeing of struct fsverity_info'; exact version: unknown from the sources\n- Reboot into the patched kernel after installing it","status":"open","published_at":"2026-10-23T13:17:28+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:04+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:54:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'fsverity: RCU-delay the freeing of struct fsverity_info'; exact version: unknown from the sources\n- Reboot into the patched kernel after installing it","reach":"local","title":"Linux kernel: fs-verity lookup can read freed memory across inodes","impact":"medium","summary":"A race in the Linux kernel's fs-verity code frees verity metadata while another thread can still look it up under RCU, causing a use-after-free for a different inode. The sources give no severity, and the description does not state what an attacker can obtain beyond a memory-safety fault.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","fs-verity","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a use-after-free in kernel memory could crash the host or be abused","analyst_note":"Find the fixed kernel versions and affected stable branches from the kernel.org commit or the NVD entry, and confirm whether an unprivileged local user can trigger the race.","how_to_check":"- `uname -r` and compare against the fixed kernel release listed by your distribution's advisory for CVE-2026-99051\n- Check whether fs-verity is in use: `unknown` from the sources; look for files enabled with `fsverity enable` or `fsverity measure` on your filesystems (ext4, f2fs, btrfs)","needs_analyst":true,"not_affected_if":["no-fsverity-use"],"who_is_affected":"Systems running a Linux kernel without the fix that use fs-verity on ext4, f2fs or btrfs are in scope, since the flaw is in how fsverity_info objects are freed. Hosts that never enable fs-verity on any file are less likely to hit the affected path, but the sources do not confirm this. unknown whether any particular configuration is safe to skip.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":3546,"output_tokens":693,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99051':15A,18A 'access':166C 'across':11A 'also':207C 'anoth':43B 'attack':75B 'beyond':78B 'broken':173C 'call':107C 'caus':52B,176C 'code':38B 'comparison':216C 'concurr':183C 'cve':13A,16A 'delay':97C,222C 'descript':69B 'differ':60B,188C 'direct':120C 'doesn':118C 'enabl':149C 'evict':143C 'failur':147C 'fast':110C 'fault':83B 'fix':217C 'follow':89C,193C 'free':39B,57B,99C,181C,224C 'freed':9A 'fs':4A,20B,36B 'fs-veriti':3A,19B,35B 'fsveriti':94C,102C,104C,123C,136C,158C,184C,194C,209C,227C 'get':105C,185C 'give':64B 'head':197C 'host':27B 'howev':170C 'info':103C,106C,125C,137C,159C,186C,195C,210C,228C 'inod':12A,61B,129C,142C,153C,169C,189C,211C 'isn':131C 'kernel':2A,22B,33B,87C 'key':215C 'linux':1A,23B,32B,86C 'lock':116C,204C 'longer':155C,164C 'look':47B 'lookup':6A,109C 'memori':10A,81B 'memory-safeti':80B 'metadata':41B 'need':156C 'obtain':77B 'problem':134C 'race':29B 'rcu':51B,96C,114C,202C,221C 'rcu-delay':95C,220C 'read':8A,115C,203C 'reli':191C 'remov':124C,139C,233C 'resolv':93C 'rhash':196C 'rhashtabl':108C,200C,236C 'runtim':24B 'safeti':82B 'self':26B 'self-host':25B 'sever':66B 'sourc':63B 'state':72B 'still':46B 'struct':101C,226C 'synchron':121C 'thread':44B 'time':144C 'upon':146C 'use':55B,113C,179C,208C 'use-after-fre':54B,178C 'veriti':5A,21B,37B,40B,150C 'via':167C 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel without the fix that use fs-verity on ext4, f2fs or btrfs are in scope, since the flaw is in how fsverity_info objects are freed. Hosts that never enable fs-verity on any file are less likely to hit the affected path, but the sources do not confirm this. unknown whether any particular configuration is safe to skip.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99051","severity":null,"published_at":"2026-10-23T13:17:28+00:00","modified_at":"2026-10-23T13:17:28+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99051","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99051","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}