CVE-2026-99051

In the Linux kernel, the following vulnerability has been resolved:

fsverity: RCU-delay the freeing of struct fsverity info

fsverity get info() calls rhashtable lookup fast(), which just uses rcu read lock() and doesn't directly synchronize with fsverity remove info().

For the same inode this isn't a problem: its fsverity info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity info and it will no longer be accessed via that inode.

However, this is broken and can cause a use-after-free for concurrent fsverity get info() for different inodes. Those rely on following fsverity info::rhash head in the rhashtable under rcu read lock() only. They also use fsverity info::inode to do the key comparison.

Fix this by RCU-delaying the freeing of 'struct fsverity info' after it's been removed from the rhashtable.