In the Linux kernel, the following vulnerability has been resolved:
ext4: turn quotas off if mount failed after enabling quotas
Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:
================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>] __x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90 ================================================================
To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-livepatch-5.15.122-77.145Upgrade kernelUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernelUpgrade kernel-livepatch-6.1.41-63.109Upgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-devel | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegraUpgrade linux-ibm-5.15Upgrade linux-lowlatencyUpgrade linux-azure-5.15Upgrade linux-ibmUpgrade linux-gkeopUpgrade linux-nvidia-tegra-5.15Upgrade linux-awsUpgrade linux-gcpUpgrade linux-oracle-5.15Upgrade linuxUpgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegra-igxUpgrade linux-kvmUpgrade linux-nvidiaUpgrade linux-intel-iotgUpgrade linux-intel-iotg-5.15Upgrade linux-raspiUpgrade linux-riscv-5.15Upgrade linux-oracleUpgrade linux-xilinx-zynqmpUpgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-gkeUpgrade linux-hwe-5.15Upgrade linux-azureUpgrade linux-aws-5.15Upgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-fde | Jan 6, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub