{"apiVersion":"1.0","identifier":"CVE-2026-99051","description":"In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn-t directly synchronize with fsverity_remove_info(). For the same inode this isn-t a problem: its fsverity_info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity_info and it will no longer be accessed via that inode. However, this is broken and can cause a use-after-free for concurrent __fsverity_get_info() for *different* inodes. Those rely on following fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only. They also use fsverity_info::inode to do the key comparison. Fix this by RCU-delaying the freeing of -struct fsverity_info- after it-s been removed from the rhashtable.","publishedAt":"2026-10-23T13:17:28","lastModifiedAt":"2026-10-24T14:16:53","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99051","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00153,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99051","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99051","en":"https://www.redsauce.net/en/cves/CVE-2026-99051","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99051","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99051","de":"https://www.redsauce.net/de/cves/CVE-2026-99051","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99051","el":"https://www.redsauce.net/el/cves/CVE-2026-99051"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99051"}}