CVE-2026-90318fat: release buffer head after rebuilding parent
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fat_scan_logstart() leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fat_scan(). fat_rebuild_parent() uses the directory entry to rebuild the parent inode for the nostale_ro NFS export path, but does not release sinfo.bh after a successful scan. Release it once fat_build_inode() has consumed the directory entry data.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before 5e44b6944e11fd6647f028219ad0be4e85e9acee; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before d2a86329152c69a6200c15b2bf618755f8563826; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before 0f18d712ba9c980e05b7e33a27cde4fe3ed2d393; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before e38587d98d1ceac608420052c0cdd901d25878f3; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before c6a67aa438179cad40f8ae45469e304338d65c0a; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before 571ea4263d69df1b48578e4314a828ecd0604755; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before 7565e44507634514e3e1899d3acad3de43f7a2c1; from f1e6fb0ab451dae8523fbb8c119a653b2730e938 before 83e98dbf19ab64e8528e101e20f8d50e1aaa68a8 | CNA record |
References
- https://git.kernel.org/stable/c/5e44b6944e11fd6647f028219ad0be4e85e9acee
- https://git.kernel.org/stable/c/d2a86329152c69a6200c15b2bf618755f8563826
- https://git.kernel.org/stable/c/0f18d712ba9c980e05b7e33a27cde4fe3ed2d393
- https://git.kernel.org/stable/c/e38587d98d1ceac608420052c0cdd901d25878f3
- https://git.kernel.org/stable/c/c6a67aa438179cad40f8ae45469e304338d65c0a
- https://git.kernel.org/stable/c/571ea4263d69df1b48578e4314a828ecd0604755
- https://git.kernel.org/stable/c/7565e44507634514e3e1899d3acad3de43f7a2c1
- https://git.kernel.org/stable/c/83e98dbf19ab64e8528e101e20f8d50e1aaa68a8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.