CVE-2026-92494

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix buffer_head leak in ext4_init_orphan_info

ext4_init_orphan_info() reads orphan file blocks with ext4_bread()

and stores the returned buffer_head in oi->of_binfo[i].ob_bh.

If ext4_bread() succeeds but the orphan block magic or checksum

validation fails, the function jumps to out_free. However, the old

out_free loop starts releasing buffers from i - 1, so the current

buffer_head at index i is skipped.

This leaks the buffer_head reference obtained by ext4_bread() on the

bad magic and bad checksum error paths.

Fix this by tracking the number of successfully read buffer_heads and

releasing exactly those buffer_heads on the error path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References