CVE-2026-46046 Overview
CVE-2026-46046 is a memory leak vulnerability in the Linux kernel's ext4 filesystem implementation. The flaw exists in the ext4_xattr_inode_dec_ref_all() function, which calls ext4_get_inode_loc() to acquire a buffer head (iloc.bh) but fails to release it with brelse() when block_csum is false. The defect was introduced by commit c8e008b60492 ("ext4: ignore xattrs past end"). Over time, repeated invocations of the affected code path can exhaust kernel buffer head resources, leading to gradual memory pressure on systems that heavily use extended attributes (xattrs) on ext4 filesystems.
Critical Impact
A reference count leak in ext4 extended attribute handling can cause kernel memory exhaustion on systems with sustained xattr operations, degrading filesystem reliability.
Affected Products
- Linux kernel versions containing commit c8e008b60492 ("ext4: ignore xattrs past end")
- Linux distributions shipping vulnerable ext4 filesystem code
- Systems mounting ext4 volumes that use extended attribute inodes
Discovery Timeline
- 2026-05-27 - CVE-2026-46046 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46046
Vulnerability Analysis
The Linux kernel ext4 filesystem stores large or numerous extended attributes in dedicated xattr inodes. When the kernel decrements references on these inodes via ext4_xattr_inode_dec_ref_all(), it must load the on-disk inode location through ext4_get_inode_loc(). That helper returns a buffer head pinned in memory for the caller to use and subsequently release.
When the block_csum parameter is false, the affected code path skips the checksum update branch and proceeds directly past the release logic. The buffer head reference acquired earlier is never freed with brelse(). Each leaked buffer head holds memory and a pinned page until the system reclaims it through other means. This classifies as a Memory Leak issue tied to incorrect resource cleanup in an error or alternative code branch.
Root Cause
The regression originated in commit c8e008b60492, which restructured xattr handling to ignore attributes located past the end of the xattr block. The restructuring removed the unconditional brelse(iloc.bh) call on the path where block_csum is false, breaking the acquire-release pairing required for buffer head reference counting.
Attack Vector
The leak triggers through normal filesystem activity that decrements references on xattr inodes, such as removing files with extended attributes or unlinking xattr-bearing inodes. A local user with the ability to create and remove files carrying extended attributes can amplify the leak. Sustained operation eventually reduces available kernel memory and may degrade filesystem performance or stability. Remote exploitation is not applicable; the issue requires local filesystem operations on a vulnerable kernel.
No proof-of-concept code is published for this issue. The fix is available across multiple stable kernel branches as referenced in the Linux Kernel stable commit history.
Detection Methods for CVE-2026-46046
Indicators of Compromise
- Steady growth of buffer_head slab allocations visible in /proc/slabinfo without a corresponding workload explanation.
- Kernel log entries indicating memory pressure, OOM kills, or slab shrinker activity on hosts with active ext4 xattr usage.
- Increasing Slab and SReclaimable values in /proc/meminfo over long uptimes on file servers handling many xattr operations.
Detection Strategies
- Compare the running kernel version and applied patches against the fix commits referenced in the stable tree updates to identify unpatched hosts.
- Monitor long-running file servers and container hosts for unexplained buffer_head slab growth correlated with xattr-heavy workloads such as SELinux labeling or Samba ACL operations.
- Use slabtop and crash to inspect buffer head allocation counts after sustained file deletion workloads on ext4 volumes.
Monitoring Recommendations
- Track kernel slab metrics over time and alert on sustained growth that does not correlate with workload changes.
- Inventory Linux hosts by kernel build to prioritize patching for systems that mount ext4 volumes with extended attributes enabled.
- Centralize kernel log telemetry to surface OOM events and memory reclaim warnings tied to filesystem workloads.
How to Mitigate CVE-2026-46046
Immediate Actions Required
- Upgrade affected systems to a Linux kernel version that includes the upstream fix referenced in the stable commit.
- Apply distribution-provided kernel updates as soon as they become available for the impacted stable branches.
- Reboot hosts after kernel updates to ensure leaked buffer heads from the prior kernel are released.
Patch Information
The upstream fix restores the missing brelse(iloc.bh) call in ext4_xattr_inode_dec_ref_all() so that the buffer head reference acquired from ext4_get_inode_loc() is released on all code paths, including when block_csum is false. Patches have been backported across multiple stable trees. See the kernel stable commits: 097227f1, 1bc1107a, 1e6b0a69, 77d05951, and f0729066.
Workarounds
- No reliable workaround exists short of patching; the leak occurs within kernel filesystem internals and cannot be disabled selectively.
- Schedule periodic reboots on long-running hosts that cannot be patched immediately to reclaim leaked buffer head memory.
- Reduce churn on extended attributes where feasible, recognizing this only slows accumulation rather than preventing it.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
