CVE-2026-46002: Linux Kernel Privilege Escalation Bug

CVE-2026-46002 Overview

CVE-2026-46002 is a Linux kernel vulnerability in the ext2 filesystem driver. The ext2_iget() function fails to reject inodes with i_nlink == 0 when paired with a non-zero i_mode and zero i_dtime. A crafted ext2 image can present such a corrupted inode to the Virtual File System (VFS) layer, triggering a WARN_ON inside drop_nlink() in fs/inode.c. The flaw is reachable through ext2_unlink(), ext2_rename(), and ext2_rmdir() code paths. Linux Verification Center identified the issue using Syzkaller fuzzing. The fix extends the existing inode validation check to report corruption via ext2_error() and return -EFSCORRUPTED.

Critical Impact
A crafted ext2 filesystem image mounted on a vulnerable kernel triggers kernel warnings and filesystem state corruption through namei operations.

Affected Products

Linux kernel ext2 filesystem driver
Linux kernel 6.12.77 and earlier stable branches referenced in commit chain
Systems mounting untrusted ext2 filesystem images

Discovery Timeline

2026-05-27 - CVE-2026-46002 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46002

Vulnerability Analysis

The vulnerability resides in ext2_iget() within the Linux kernel ext2 driver. The function already rejects inodes where i_nlink == 0 combined with either a zero i_mode or a set i_dtime, treating them as deleted. However, the combination of i_nlink == 0, non-zero i_mode, and zero i_dtime is not validated. Because ext2 lacks an orphan list, this state can only arise from filesystem corruption or a deliberately crafted image. Legitimate deletion in ext2 always sets i_dtime or clears i_mode before freeing the inode.

Root Cause

The root cause is incomplete input validation [CWE-20] of on-disk inode metadata during inode load. The integrity check in ext2_iget() covers only two of the three corruption patterns that produce a zero link count on a non-deleted inode. The third pattern bypasses validation and reaches VFS-level link manipulation routines.

Attack Vector

An attacker supplies a crafted ext2 filesystem image containing an inode with i_nlink = 0, a valid i_mode, and i_dtime = 0. When userspace executes unlink(), rename(), or rmdir() on a path referencing this inode, the kernel calls inode_dec_link_count(), which invokes drop_nlink(). Because the link count is already zero, drop_nlink() triggers a WARN_ON at fs/inode.c:336. The condition requires mounting an untrusted ext2 image, typically achievable by a local user with mount privileges or via automatic mount of removable media.

The vulnerability is described in the kernel commit messages referenced below. No public exploitation code is available beyond the Syzkaller reproducer used by the Linux Verification Center.

Detection Methods for CVE-2026-46002

Indicators of Compromise

Kernel log entries containing WARNING: ... drop_nlink+0xad/0xd0 fs/inode.c:336 following filesystem operations
ext2_error() messages referencing inodes with zero i_nlink and non-zero i_mode
Unexpected -EFSCORRUPTED (EUCLEAN) errors returned from ext2 mounts after patching
Mount events for ext2 images originating from removable media or user-controlled sources

Detection Strategies

Monitor dmesg and /var/log/kern.log for drop_nlink warnings tied to ext2_unlink, ext2_rename, or ext2_rmdir call stacks
Audit mount syscalls for ext2 filesystems mounted from non-trusted block devices or loop devices
Apply file integrity monitoring on kernel modules and filesystem drivers to detect tampering

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized SIEM and alert on WARN_ON patterns originating in fs/inode.c
Track mount operations on workstations and servers, flagging ext2 mounts of external images
Correlate kernel warnings with the invoking process and user identity to identify suspicious activity

How to Mitigate CVE-2026-46002

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commit chain to all affected stable branches
Restrict mounting of untrusted ext2 filesystem images to administrators only
Disable automatic mounting of removable media on systems that do not require it
Inventory systems running affected stable kernel versions and prioritize patching of multi-tenant hosts

Patch Information

The fix extends the validation in ext2_iget() to reject inodes with i_nlink == 0 and a valid i_mode, reporting corruption via ext2_error() and returning -EFSCORRUPTED. This prevents the inode from reaching namei.c paths. Patches are available in the following commits: Kernel Git Commit 25947cc5, Kernel Git Commit 2dde6377, Kernel Git Commit 32e0b925, Kernel Git Commit 470264bb, and Kernel Git Commit d3af04a4.

Workarounds

Restrict the CAP_SYS_ADMIN capability and limit which users can issue mount syscalls
Configure udev and desktop environments to disable auto-mounting of ext2 volumes from removable devices
Use mandatory access control policies (SELinux, AppArmor) to block mounting of user-supplied filesystem images
Where ext2 support is not required, unload or blacklist the ext2 kernel module

bash

# Blacklist the ext2 module on systems that do not require it
echo 'blacklist ext2' | sudo tee /etc/modprobe.d/blacklist-ext2.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep ext2