CVE-2026-46002

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()

ext2_iget() already rejects inodes with i_nlink == 0 when i_mode is

zero or i_dtime is set, treating them as deleted. However, the case of

i_nlink == 0 with a non-zero mode and zero dtime slips through. Since

ext2 has no orphan list, such a combination can only result from

filesystem corruption - a legitimate inode deletion always sets either

i_dtime or clears i_mode before freeing the inode.

A crafted image can exploit this gap to present such an inode to the

VFS, which then triggers WARN_ON inside drop_nlink() (fs/inode.c) via

ext2_unlink(), ext2_rename() and ext2_rmdir():

WARNING: CPU: 3 PID: 609 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336

CPU: 3 UID: 0 PID: 609 Comm: syz-executor Not tainted 6.12.77+ #1

Call Trace:

<TASK>

inode_dec_link_count include/linux/fs.h:2518 [inline]

ext2_unlink+0x26c/0x300 fs/ext2/namei.c:295

vfs_unlink+0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References