CVE-2026-90318
fat: release buffer head after rebuilding parent
Description
In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fat_scan_logstart() leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fat_scan(). fat_rebuild_parent() uses the directory entry to rebuild the parent inode for the nostale_ro NFS export path, but does not release sinfo.bh after a successful scan. Release it once fat_build_inode() has consumed the directory entry data.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 17, 2026, 5:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the Linux kernel patch for the FAT filesystem.
- Ensure buffer heads are released after parent inode rebuild.
- Update the Linux kernel to the latest secure version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90318.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90318 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90318
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90318 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90318 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fat_scan_logstart() leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fat_scan(). fat_rebuild_parent() uses the directory entry to rebuild the parent inode for the nostale_ro NFS export path, but does not release sinfo.bh after a successful scan. Release it once fat_build_inode() has consumed the directory entry data. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90318.json">CVE-2026-90318</a> Added Reference https://git.kernel.org/stable/c/0f18d712ba9c980e05b7e33a27cde4fe3ed2d393 Added Reference https://git.kernel.org/stable/c/571ea4263d69df1b48578e4314a828ecd0604755 Added Reference https://git.kernel.org/stable/c/5e44b6944e11fd6647f028219ad0be4e85e9acee Added Reference https://git.kernel.org/stable/c/7565e44507634514e3e1899d3acad3de43f7a2c1 Added Reference https://git.kernel.org/stable/c/83e98dbf19ab64e8528e101e20f8d50e1aaa68a8 Added Reference https://git.kernel.org/stable/c/c6a67aa438179cad40f8ae45469e304338d65c0a Added Reference https://git.kernel.org/stable/c/d2a86329152c69a6200c15b2bf618755f8563826 Added Reference https://git.kernel.org/stable/c/e38587d98d1ceac608420052c0cdd901d25878f3