vulnerability in Linux kernel affects ext4, f2fs, and tmpfs file systems

CVE-2026-99180

What is CVE-2026-99180?

A use-after-free vulnerability exists in the Linux kernel's handling of unicode mapping during pathwalks. When a filesystem accesses the unicode map during a concurrent operation, it may inadvertently read freed memory, potentially leading to system instability and unauthorized access. This occurs in ext4, f2fs, and tmpfs file systems when the reference to the mount is released but a pathwalk is still active. To mitigate this issue, the kernel now delays the memory free until a grace period has passed, ensuring that all operations complete before releasing resources.

References