In the Linux kernel, the following vulnerability has been resolved:
ext4: turn quotas off if mount failed after enabling quotas
Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:
================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>] __x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90 ================================================================
To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade perfUpgrade python-perfUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.122-77.145Upgrade bpftoolUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade bpftoolUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade python3-perfUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel-livepatch-6.1.41-63.109 | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-oracleUpgrade linux-gkeUpgrade linux-aws-5.15Upgrade linux-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-xilinx-zynqmpUpgrade linux-azure-fdeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidiaUpgrade linux-azureUpgrade linux-bluefieldUpgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-intel-iotg-5.15Upgrade linux-riscv-5.15Upgrade linux-raspiUpgrade linux-ibmUpgrade linux-gcpUpgrade linux-ibm-5.15Upgrade linux-gkeopUpgrade linux-nvidia-tegra-igxUpgrade linux-awsUpgrade linux-nvidia-tegra-5.15Upgrade linux-oracle-5.15Upgrade linux-azure-5.15Upgrade linux-nvidia-tegraUpgrade linux-intel-iot-realtimeUpgrade linuxUpgrade linux-lowlatency | Jan 6, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub