CVE-2026-45915: Linux Kernel FAT Privilege Escalation

CVE-2026-45915 Overview

CVE-2026-45915 is a Linux kernel vulnerability in the FAT filesystem implementation. Corrupted FAT images can leave a directory inode with an incorrect i_nlink value (e.g., 2 even though subdirectories exist). When rmdir is invoked, the kernel unconditionally calls drop_nlink(dir), which can drive i_nlink to 0 and trigger the WARN_ON in drop_nlink(). The flaw resides in vfat_rmdir() and msdos_rmdir() and is triggered by mounting or operating on a malformed FAT image. The Linux kernel maintainers have resolved the issue across multiple stable branches.

Critical Impact
A locally accessible attacker who can mount or supply a crafted FAT filesystem image can trigger a kernel warning through link count underflow, potentially leading to denial of service or filesystem state corruption.

Affected Products

Linux kernel (FAT filesystem subsystem)
vfat driver — vfat_rmdir() code path
msdos driver — msdos_rmdir() code path

Discovery Timeline

2026-05-27 - CVE-2026-45915 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45915

Vulnerability Analysis

The vulnerability is an integer underflow in the parent directory link count handling within the Linux FAT filesystem. When a directory is removed using rmdir, the kernel decrements the parent directory's i_nlink counter via drop_nlink(). The FAT code performed this decrement unconditionally without validating the current link count.

A correctly formed directory inode has an i_nlink value of at least 3 when it contains subdirectories (one for the entry itself, one for ., and one or more for each child .. entry). A corrupted FAT image can present a directory whose recorded link count does not match this invariant. Removing a subdirectory under such a parent drives i_nlink toward zero and triggers the WARN_ON inside drop_nlink(), producing kernel log noise and leaving the inode in an inconsistent state.

Root Cause

The root cause is missing input validation [CWE-20] on filesystem metadata sourced from untrusted media. vfat_rmdir() and msdos_rmdir() trusted the on-disk link count without performing a sanity check before calling drop_nlink() on the parent inode.

Attack Vector

An attacker requires the ability to supply a crafted FAT-formatted volume — for example, via a USB device, loopback-mounted image, or any storage automatically mounted by the system. After mounting, performing rmdir on a subdirectory of a parent with a manipulated i_nlink value triggers the underflow. The fix introduces a sanity check that only decrements the parent link count when it is at least 3, otherwise reporting a filesystem error. Patch commits are available in the upstream stable tree, including commit 17866f8a0822 and commit d3b7ffa90f61.

Detection Methods for CVE-2026-45915

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating from drop_nlink() with call sites in fs/fat/namei_vfat.c or fs/fat/namei_msdos.c.
Filesystem error messages from the FAT driver indicating inconsistent parent link counts on mounted volumes.
Mount events for FAT, VFAT, or MSDOS filesystems originating from removable media or user-supplied disk images on multi-user systems.

Detection Strategies

Monitor dmesg and /var/log/kern.log for WARN_ON stack traces involving drop_nlink, vfat_rmdir, or msdos_rmdir.
Audit kernel versions across the fleet and flag hosts running unpatched FAT code paths.
Inspect automounter and udev policies that permit unprivileged users to attach FAT-formatted media.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging or SIEM platform for correlation across hosts.
Alert on any mount of FAT/VFAT/MSDOS filesystems from removable devices on production servers where such mounts are not expected.
Track rmdir syscall activity on FAT-mounted paths through audit subsystem rules.

How to Mitigate CVE-2026-45915

Immediate Actions Required

Apply the upstream Linux stable patches that introduce the parent link count sanity check in vfat_rmdir() and msdos_rmdir().
Restrict mounting of FAT-formatted volumes to trusted users and disable automatic mounting of removable media on servers.
Rebuild and redeploy custom kernels to include the fix on any hosts running long-term support branches.

Patch Information

The issue is fixed across multiple Linux stable branches. Relevant commits include 17866f8a0822, 7fe0de287e93, 8cafcb881364, 955c5d670b5a, 9894c79fd946, cd569b87378b, d0bb592fa9de, and d3b7ffa90f61. The fix only drops the parent link count when it is at least 3, otherwise reporting a filesystem error.

Workarounds

Disable the vfat and msdos kernel modules on systems that do not require FAT support by blacklisting them in /etc/modprobe.d/.
Configure udev or the automounter to deny mounting of FAT volumes from untrusted devices.
Limit physical and virtual access to systems where USB or removable media attachment is possible.

bash

# Configuration example: blacklist FAT modules to prevent loading
echo 'blacklist vfat'  | sudo tee /etc/modprobe.d/blacklist-fat.conf
echo 'blacklist msdos' | sudo tee -a /etc/modprobe.d/blacklist-fat.conf
echo 'blacklist fat'   | sudo tee -a /etc/modprobe.d/blacklist-fat.conf
sudo update-initramfs -u