In the Linux kernel, the following vulnerability has been resolved:
ext4: fix missing brelse() in ext4xattrinodedecref_all()
The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false.
ext4xattrinodedecrefall() calls ext4getinodeloc() to get iloc.bh, but never releases it with brelse().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46046.json",
"cna_assigner": "Linux"
}