What’s Vulnerable › Vulnerabilities

CVE-2026-23145: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-14 · updated 2026-10-19
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.

Affected products

• Linux kernel: from 5.4.301 before 5.5; from 5.10.246 before 5.10.249; from 5.15.195 before 5.15.199; from 6.1.157 before 6.1.162; from 6.6.113 before 6.6.122; from 6.12.54 before 6.12.67 — fixed in 5.10.249, 5.15.199, 5.5, 6.1.162, 6.12.67, 6.18.7

How to fix

Upgrade to a fixed version: Linux kernel 5.10.249, 5.15.199, 5.5, 6.1.162. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/06e26287f2e349a28ad363941ffd9076bfed8b2e
• https://git.kernel.org/stable/c/0b06cde92f2f960f4ebe3c988c69f2711f2a24dc
• https://git.kernel.org/stable/c/3b00c16e42428a1ecd3a5eb9cc37f8ad9bd47626
• https://git.kernel.org/stable/c/6241cd1d0acc2363016ac55b8773ba1332dd59d7
• https://git.kernel.org/stable/c/7c9f059c3d531a12d7ad96cd34a44b8af7c00d5f
• https://git.kernel.org/stable/c/8e8542c539927ae3898a4d02941f84e252e2dea1
• https://git.kernel.org/stable/c/d250bdf531d9cd4096fedbb9f172bb2ca660c868

Get alerted when CVE-2026-23145 or the next vulnerability affects your stack