CVE-2026-46002

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ext2 filesystem where the ext2 iget() function fails to reject inodes that have a link count i nlink of zero while maintaining a valid mode and a zero deletion time i dtime. This specific combination typically indicates filesystem corruption, as legitimate deletions should either clear the mode or set the deletion time. A crafted image can exploit this to present such an inode to the Virtual File System (VFS), triggering a warning in the drop nlink() function when called via ext2 unlink(), ext2 rename(), or ext2 rmdir().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.