Information Disclosure Vulnerability in Linux Kernel ext4 Filesystem by Vendor

CVE-2026-99174

What is CVE-2026-99174?

A flaw in the Linux kernel's ext4 filesystem can lead to information disclosure during file path lookups. The vulnerability arises when a symlink is followed in a manner that may expose sensitive data. Specifically, an improperly managed grace period can result in a situation where the metadata becomes dereferenced, leading to potential exposure of data integrity issues. The ext4_get_link function may access a NULL pointer, causing a crash or leaking data when the filesystem is under certain conditions, such as when a mount reference is dropped unexpectedly. The issue underscores the importance of waiting for grace periods to complete before freeing system resources.

References