{"id":"CVE-2026-99174","kind":"vulnerability","aliases":["CVE-2026-99174"],"related":[],"title":"Linux ext4: freed mount state can be read during symlink lookup, crashing kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: free the sbi after a grace period\n\next4_get_link() follows a symlink that keeps its target in a data block\nin rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT).\nThat reads s_mount_state in the ASSERT() of ext4_getblk() and again in\next4_es_lookup_extent(), and the lookup bumps the extent status hit or\nmiss counter, all through sb->s_fs_info.\n\next4_put_super() destroys those counters, clears sb->s_fs_info and frees\nthe sbi without waiting for a grace period. A pathwalk that is still in\next4_get_link() when the last reference to the mount goes away then\ndereferences a NULL s_fs_info, the freed sbi or the destroyed percpu\ncounters.\n\nWith a pathwalk held up in ext4_get_link() while the last reference\ngoes away:\n\n  KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]\n  RIP: 0010:ext4_getblk+0xf0/0x640\n  Call Trace:\n   <TASK>\n   ext4_get_link+0x26c/0x410\n   pick_link+0xf96/0x1780\n   step_into_slowpath+0x9b8/0x1250\n   path_lookupat+0x484/0xb00\n   filename_lookup+0x1f1/0x5b0\n   vfs_statx+0xd7/0x3b0\n   vfs_fstatat+0x4d/0x90\n   __do_sys_newfstatat+0xa0/0x100\n   do_syscall_64+0x10e/0x5e0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSo far that has been hard to hit. umount(2) waits for a grace period in\nnamespace_unlock() before it drops the mount, so only a mount whose last\nreference goes away elsewhere, like the close of a file or a chdir out of\na lazily unmounted directory, can race a walker.\n\nKeep sb->s_fs_info and free the sbi together with the extent status\ncounters after a grace period. Split the counters out of\next4_es_unregister_shrinker() for that. The shrinker still gets wasted\nin ext4_put_super(), the counters go with the sbi.","summary":"When an ext4 filesystem unmounts while a path lookup is following a symlink, the kernel can read freed or cleared mount state, causing a null pointer dereference. The sources describe a kernel crash and do not describe an attacker gaining code execution or data access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ext4","kernel","linux","other"],"not_affected_if":["no-ext4-mounts"],"how_to_check":"- `uname -r` to see the running kernel version\n- `grep -i ext4 /proc/filesystems` to confirm the ext4 driver is present\n- unknown whether the sources list affected kernel version ranges","fix":"- Install the kernel release that contains the upstream ext4 fix for this CVE once your distribution ships it\n- unknown exact fixed kernel version, as the sources do not say","status":"open","published_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:33+00:00","updated_at":"2026-10-28T11:35:33+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T11:35:33Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel release that contains the upstream ext4 fix for this CVE once your distribution ships it\n- unknown exact fixed kernel version, as the sources do not say","reach":"local","title":"Linux ext4: freed mount state can be read during symlink lookup, crashing kernel","impact":"medium","summary":"When an ext4 filesystem unmounts while a path lookup is following a symlink, the kernel can read freed or cleared mount state, causing a null pointer dereference. The sources describe a kernel crash and do not describe an attacker gaining code execution or data access.","category":"other","nicknames":[],"who_cares":["linux","ext4","kernel"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel null dereference crashes the host","analyst_note":"Check the kernel.org stable commit for the ext4 sbi grace-period fix to get affected and fixed kernel versions and confirm whether a local user can trigger the crash.","how_to_check":"- `uname -r` to see the running kernel version\n- `grep -i ext4 /proc/filesystems` to confirm the ext4 driver is present\n- unknown whether the sources list affected kernel version ranges","needs_analyst":true,"not_affected_if":["no-ext4-mounts"],"who_is_affected":"Systems running Linux kernels with ext4 mounts where filesystems are unmounted or have their last reference dropped while other processes are doing path lookups. The sources do not describe a specific configuration or deployment. Hosts that use only other filesystems, or that never unmount ext4 volumes under load, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4002,"output_tokens":597,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':230C,237C,241C,246C,250C,254C,258C,262C,267C,272C,279C '-2026':15A,18A '-99174':16A,19A '0010':227C '0x00000000000000a8':224C '0x00000000000000a8-0x00000000000000af':223C '0x00000000000000af':225C '2':290C '64':271C,276C 'access':67B 'assert':119C 'attack':61B 'away':185C,215C,312C 'block':99C,109C 'bump':133C 'cach':110C 'call':232C 'caus':45B 'chdir':322C 'clear':42B,153C 'close':316C 'code':63B 'counter':140C,152C,200C,347C,354C,373C 'crash':12A,55B 'cve':14A,17A 'data':66B,98C 'deref':220C 'derefer':49B,187C 'describ':52B,59B 'destroy':150C,198C 'directori':328C 'drop':301C 'elsewher':313C 'entri':274C 'es':127C,358C 'execut':64B 'ext4':2A,20B,25B,78C,86C,105C,107C,121C,126C,147C,174C,207C,228C,234C,357C,369C 'extent':129C,135C,345C 'far':282C 'file':319C 'filenam':252C 'filesystem':26B 'follow':33B,73C,89C 'free':79C,159C,339C 'freed':3A,40B,194C 'fs':145C,156C,191C,336C 'fstatat':261C 'gain':62B 'get':87C,108C,175C,208C,235C,366C 'getblk':106C,122C,229C 'go':374C 'goe':184C,214C,311C 'grace':84C,166C,294C,350C 'hard':286C 'held':204C 'hit':137C,288C 'hwframe':278C 'info':146C,157C,192C,337C 'kasan':216C 'keep':93C,333C 'kernel':13A,21B,37B,54B,71C 'last':179C,212C,309C 'lazili':326C 'like':314C 'link':88C,176C,209C,236C,240C 'linux':1A,22B,70C 'lookup':11A,31B,128C,132C,253C 'lookupat':249C 'miss':139C 'mode':103C 'mount':4A,43B,115C,183C,303C,307C 'namespac':297C 'newfstatat':266C 'nowait':111C 'null':47B,189C,218C 'null-ptr-deref':217C 'path':30B,248C 'pathwalk':102C,169C,203C 'percpu':199C 'period':85C,167C,295C,351C 'pick':239C 'pointer':48B 'ptr':219C 'put':148C,370C 'race':330C 'rang':222C 'rcu':101C 'read':8A,39B,113C 'refer':180C,213C,310C 'resolv':77C 'rip':226C 'sb':143C,154C,334C 'sbi':81C,161C,195C,341C,377C 'shrinker':360C,364C 'slowpath':245C 'sourc':51B 'split':352C 'state':5A,44B,116C 'status':136C,346C 'statx':257C 'step':243C 'still':172C,365C 'super':149C,371C 'symlink':10A,35B,91C 'sys':265C 'syscal':270C,275C 'target':95C 'togeth':342C 'trace':233C 'umount':289C 'unlock':298C 'unmount':27B,327C 'unregist':359C 'vfs':256C,260C 'vulner':74C 'wait':163C,291C 'walker':332C 'wast':367C 'whose':308C 'without':162C 'x10e/0x5e0':273C 'x1f1/0x5b0':255C 'x26c/0x410':238C 'x484/0xb00':251C 'x4d/0x90':263C 'x77/0x7f':280C 'x9b8/0x1250':247C 'xa0/0x100':268C 'xd7/0x3b0':259C 'xf0/0x640':231C 'xf96/0x1780':242C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with ext4 mounts where filesystems are unmounted or have their last reference dropped while other processes are doing path lookups. The sources do not describe a specific configuration or deployment. Hosts that use only other filesystems, or that never unmount ext4 volumes under load, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99174","severity":null,"published_at":"2026-10-28T11:17:38+00:00","modified_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}