Linux kernel fs-verity: Use-after-free in fsverity_info lookup
Summary
A race condition in the fs-verity subsystem of the Linux kernel can lead to a use-after-free of struct fsverity_info. Concurrent lookups for different inodes can access an object that has already been removed from the hash table and freed. A local user with an account or code execution could affect the system; the CVSS 3.1 vector rates the confidentiality, integrity and availability impact as high. Systems that do not use fs-verity are very unlikely to be affected.
Affected
- Linux kernel from 7.0, introduced by commit f77f281b61183a5c0b87e6a4d101c70bd32c1c79
- Affected ranges differ between sources (for example up to 7.2.10 per VulDB; Ubuntu 26.10 builds 7.0.0-14.14 to 7.3.0-9.9 per OffSeq)
- Unknown: exact fixed kernel version per stable branch
Fixed in
- Upstream stable commits e58c3805ed325fe2d4ae2dd467c0486cc860b733 and fa84f091a8e7fc46fd29834496fab9739dd4c8dc
- OSV lists 7.2.11 as fixed
- Unknown: fixed package versions from Ubuntu, SUSE and Debian
Workaround
Unknown. No vendor workaround is documented. Apply a kernel update that includes the fix.
Exploitation
- Not known to be exploited in the wild (OffSeq: no evidence on record)
- No public proof of concept known
- EPSS 0.00153; not listed in CISA KEV in the reviewed sources
Our recommendation
- Check whether fs-verity is used on your systems.
- Prioritise shared multi-user Linux hosts and servers where untrusted users can run code.
- Include the fixed kernel in the next regular kernel update; use an emergency change only for high-exposure systems.
- Monitor your distribution's security tracker and re-assess if a public PoC or KEV entry appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream fix commit e58c3805ed325fe2d4ae2dd467c0486cc860b733 git.kernel.org
- Upstream fix commit fa84f091a8e7fc46fd29834496fab9739dd4c8dc git.kernel.org
- Ubuntu security tracker ubuntu.com
- NVD record via Vulners vulners.com
- OSV record via Vulners vulners.com
- Upstream patch discussion (linux-fsdevel/vfs PR #2761) github.com
- VulDB entry vuldb.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:24.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn't directly synchronize with fsverity_remove_info(). For the same inode this isn't a problem: its fsverity_info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity_info and it will no longer be accessed via that inode. However, this is broken and can cause a use-after-free for concurrent __fsverity_get_info() for *different* inodes. Those rely on following fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only. They also use fsverity_info::inode to do the key comparison. Fix this by RCU-delaying the freeing of 'struct fsverity_info' after it's been removed from the rhashtable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.