CVE-2026-23145

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref

The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= 1cfb3e4ddbdc8e02e637b8852540bd4718bf4814, < 7c9f059c3d531a12d7ad96cd34a44b8af7c00d5f; >= 505e69f76ac497e788f4ea0267826ec7266b40c8, < 6241cd1d0acc2363016ac55b8773ba1332dd59d7; >= 3d6269028246f4484bfed403c947a114bb583631, < 3b00c16e42428a1ecd3a5eb9cc37f8ad9bd47626; >= 79ea7f3e11effe1bd9e753172981d9029133a278, < 0b06cde92f2f960f4ebe3c988c69f2711f2a24dc; >= 6b879c4c6bbaab03c0ad2a983953bd1410bb165e, < 8e8542c539927ae3898a4d02941f84e252e2dea1; >= 57295e835408d8d425bef58da5253465db3d6888, < 06e26287f2e349a28ad363941ffd9076bfed8b2e; >= 57295e835408d8d425bef58da5253465db3d6888, < d250bdf531d9cd4096fedbb9f172bb2ca660c868; ea39e712c2f5ae148ee5515798ae03523673e002; 440b003f449a4ff2a00b08c8eab9ba5cd28f3943; >= 5.10.246, < 5.10.249; >= 5.15.195, < 5.15.199; >= 6.1.157, < 6.1.162; >= 6.6.113, < 6.6.122; >= 6.12.54, < 6.12.67; >= 5.4.301, < 5.5; >= 6.17.4, < 6.18
LinuxLinux6.18

References

Timeline

Published
Feb 14, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-231465.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uarCVE-2026-231475.5In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix the folio leak on S390 hardware acceleration [BUG] AfCVE-2026-231485.5In the Linux kernel, the following vulnerability has been resolved: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereferenceCVE-2026-231495.5In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_changCVE-2026-23158.8Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of boundCVE-2026-231505.5In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). syzbot reported vaCVE-2026-231515.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in set_ssp_complete Fix memory leak iCVE-2026-231525.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: correctly decode TTLM with default link map TID-To-LinCVE-2026-231534.7In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list oCVE-2026-231545.5In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GCVE-2026-231555.5In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Sinc coCVE-2026-231567.8In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get
CVE-2026-23145: Medium severity, CVSS 5.5 | Vulnix