{
"schemaVersion": 1,
"attribution": [
{
"source": "CISA Known Exploited Vulnerabilities",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"licence": "US government work"
},
{
"source": "GitHub Advisory Database",
"url": "https://github.com/advisories",
"licence": "CC BY 4.0"
},
{
"source": "Have I Been Pwned",
"url": "https://haveibeenpwned.com/",
"licence": "CC BY 4.0"
},
{
"source": "CVE Program (CVE records)",
"url": "https://www.cve.org/Legal/TermsOfUse",
"licence": "CVE Terms of Use",
"notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
"terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
},
{
"source": "FIRST EPSS",
"url": "https://www.first.org/epss/",
"licence": "free to use; FIRST requests attribution"
}
],
"record": {
"id": "CVE-2026-46002",
"sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-46002",
"idYear": 2026,
"status": "PUBLISHED",
"publishedAt": "2026-05-27T12:55:57.898Z",
"updatedAt": "2026-06-14T17:47:19.832Z",
"importedAt": "2026-10-24T01:58:14.884Z",
"snapshot": {
"id": "cve_2026-10-24_midnight_baseline",
"at": "2026-10-24T00:00:00.000Z",
"source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
},
"facts": {
"title": "ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()",
"summary": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: reject inodes with zero i_nlink and valid mode in ext2_iget()\n\next2_iget() already rejects inodes with i_nlink == 0 when i_mode is\nzero or i_dtime is set, treating them as deleted. However, the case of\ni_nlink == 0 with a non-zero mode and zero dtime slips through. Since\next2 has no orphan list, such a combination can only result from\nfilesystem corruption - a legitimate inode deletion always sets either\ni_dtime or clears i_mode before freeing the inode.\n\nA crafted image can exploit this gap to present such an inode to the\nVFS, which then triggers WARN_ON inside drop_nlink() (fs/inode.c) via\next2_unlink(), ext2_rename() and ext2_rmdir():\n\nWARNING: CPU: 3 PID: 609 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336\nCPU: 3 UID: 0 PID: 609 Comm: syz-executor Not tainted 6.12.77+ #1\nCall Trace:\n \n inode_dec_link_count include/linux/fs.h:2518 [inline]\n ext2_unlink+0x26c/0x300 fs/ext2/namei.c:295\n vfs_unlink+0x2fc/0x9b0 fs/namei.c:4477\n do_unlinkat+0x53e/0x730 fs/namei.c:4541\n __x64_sys_unlink+0xc6/0x110 fs/namei.c:4587\n do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\nWARNING: CPU: 0 PID: 646 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336\nCPU: 0 UID: 0 PID: 646 Comm: syz.0.17 Not tainted 6.12.77+ #1\nCall Trace:\n \n inode_dec_link_count include/linux/fs.h:2518 [inline]\n ext2_rename+0x35e/0x850 fs/ext2/namei.c:374\n vfs_rename+0xf2f/0x2060 fs/namei.c:5021\n do_renameat2+0xbe2/0xd50 fs/namei.c:5178\n __x64_sys_rename+0x7e/0xa0 fs/namei.c:5223\n do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\nWARNING: CPU: 0 PID: 634 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336\nCPU: 0 UID: 0 PID: 634 Comm: syz-executor Not tainted 6.12.77+ #1\nCall Trace:\n \n inode_dec_link_count include/linux/fs.h:2518 [inline]\n ext2_rmdir+0xca/0x110 fs/ext2/namei.c:311\n vfs_rmdir+0x204/0x690 fs/namei.c:4348\n do_rmdir+0x372/0x3e0 fs/namei.c:4407\n __x64_sys_unlinkat+0xf0/0x130 fs/namei.c:4577\n do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\nExtend the existing i_nlink == 0 check to also catch this case,\nreporting the corruption via ext2_error() and returning -EFSCORRUPTED.\nThis rejects the inode at load time and prevents it from reaching any\nof the namei.c paths.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "1b80cf48bcf0e1937af9cd6c7beb188762bbf7c5"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "9e2d67fb2b73eeff8b601e26b332128eae8147bb"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "a69a0c5156b6f0092b9fcf44517f5831a962de2d"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "32e0b925572686399243834ec99e2a9d85c62eae"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "d3af04a43db86379df7438bf8bade71685b8a239"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "2dde6377ab2e46bb80cf066c659ef016f3ad7a9b"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "470264bbec499e276a89a6431144ae58f411ea4d"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"status": "affected",
"versionType": "git",
"lessThan": "25947cc5b2374cd5bf627fe3141496444260d04f"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"versions": [
{
"version": "2.6.12",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "2.6.12"
},
{
"version": "5.10.258",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"version": "5.15.209",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"version": "6.1.175",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"version": "6.6.140",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"version": "6.12.86",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"version": "6.18.27",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"version": "7.0.4",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"version": "7.1",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
]
}
}
}