CVE-2026-23145: Linux Kernel Information Disclosure Bug

CVE-2026-23145 Overview

A memory leak vulnerability has been identified in the Linux kernel's ext4 filesystem subsystem. The issue exists in the ext4_xattr_inode_update_ref function, where an error handling branch fails to properly release the reference count for iloc.bh (buffer head). This resource leak can lead to memory exhaustion over time, potentially causing system instability or denial of service conditions on affected systems.

Critical Impact

Memory leak in ext4 extended attribute handling can lead to resource exhaustion and system instability on Linux systems using ext4 filesystems.

Affected Products

• Linux Kernel (multiple versions with ext4 filesystem support)

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23145 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23145

Vulnerability Analysis

This vulnerability is classified as a Memory Leak within the Linux kernel's ext4 filesystem implementation. The flaw resides in the ext4_xattr_inode_update_ref function, which is responsible for managing reference counts for extended attribute (xattr) inodes. Extended attributes in ext4 allow storing metadata beyond the standard filesystem attributes, and proper reference counting is essential for memory management.

The issue was discovered during code review, indicating the defect had been present but not yet exploited in the wild. When the function encounters an error condition, it fails to call the appropriate buffer head release function (brelse() or similar) for the iloc.bh structure before returning. This results in a reference count that is never decremented, preventing the kernel from freeing the associated memory.

Root Cause

The root cause of this vulnerability is improper resource cleanup in error handling paths. Specifically, when ext4_xattr_inode_update_ref encounters an error condition after acquiring a reference to iloc.bh, the error branch exits without releasing that reference. This violates the kernel's memory management conventions where every acquired reference must be explicitly released. The missing brelse() or equivalent call in the error path creates a buffer head leak that accumulates over time.

Attack Vector

While no known exploits are currently available for this vulnerability, the attack vector involves triggering repeated error conditions in extended attribute operations on ext4 filesystems. An attacker with local access could potentially:

1. Perform filesystem operations that invoke ext4_xattr_inode_update_ref
2. Trigger specific error conditions that cause the function to take the vulnerable error path
3. Repeat this process to gradually exhaust kernel memory resources

The vulnerability requires local access to a system with an ext4 filesystem mounted. Over time, the accumulated memory leaks could degrade system performance or cause kernel out-of-memory conditions.

Detection Methods for CVE-2026-23145

Indicators of Compromise

• Gradual increase in kernel memory usage (slab memory) without corresponding increase in application memory demand
• slabtop or /proc/slabinfo showing increasing allocation counts for buffer_head objects
• System memory pressure warnings or OOM killer activations without obvious cause
• Kernel log messages related to ext4 xattr operations or memory allocation failures

Detection Strategies

• Monitor kernel memory usage patterns using tools like vmstat, slabtop, and /proc/meminfo
• Implement alerting on sustained growth in buffer_head slab allocations
• Use kernel debugging features like kmemleak to detect unreleased memory allocations
• Deploy SentinelOne agents to monitor for unusual system resource consumption patterns

Monitoring Recommendations

• Establish baseline metrics for kernel slab memory usage on ext4-based systems
• Configure alerts for buffer_head allocation growth exceeding normal operational thresholds
• Monitor filesystem operations that heavily utilize extended attributes
• Review system logs for ext4-related error messages that may indicate exploitation attempts

How to Mitigate CVE-2026-23145

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for this vulnerability
• Monitor affected systems for signs of memory exhaustion pending patch deployment
• Consider limiting local user access to systems running vulnerable kernel versions
• Prioritize patching for systems with high ext4 extended attribute usage

Patch Information

The Linux kernel development team has released patches to address this vulnerability. Multiple commits have been made to the stable kernel branches to fix the iloc.bh reference leak in ext4_xattr_inode_update_ref. The following patch commits are available:

• Linux Kernel Commit Update 1
• Linux Kernel Commit Update 2
• Linux Kernel Commit Update 3
• Linux Kernel Commit Update 4
• Linux Kernel Commit Update 5
• Linux Kernel Commit Update 6
• Linux Kernel Commit Update 7

Administrators should apply the appropriate patch for their kernel version through their distribution's package management system or by building from source.

Workarounds

• If patching is not immediately possible, consider reducing the use of extended attributes on ext4 filesystems
• Schedule periodic system reboots to reclaim leaked memory on heavily affected systems
• Monitor memory usage closely and set up automated alerting for memory exhaustion conditions
• Where feasible, consider temporary use of alternative filesystems that do not have this vulnerability

# Check current kernel version and verify patch status
uname -r

# Monitor buffer_head slab usage for signs of memory leak
cat /proc/slabinfo | grep buffer_head

# Use slabtop for real-time slab monitoring
slabtop -s c