{
  "cveId": "CVE-2026-99051",
  "url": "https://patchblox.com/security/cve/CVE-2026-99051",
  "summary": "CVE-2026-99051 is fixed in linux on 1 platform by DEBIAN-CVE-2026-99051 (version 7.2.11-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  fsverity: RCU-delay the freeing of struct fsveri...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  fsverity: RCU-delay the freeing of struct fsverity_info  __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn\u0027t directly synchronize with fsverity_remove_info().  For the same inode this isn\u0027t a problem: its fsverity_info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity_info and it will no longer be accessed via that inode.  However, this is broken and can cause a use-after-free for concurrent __fsverity_get_info() for *different* inodes.  Those rely on following fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only. They also use fsverity_info::inode to do the key comparison.  Fix this by RCU-delaying the freeing of \u0027struct fsverity_info\u0027 after it\u0027s been removed from the rhashtable.",
  "published": "2026-10-23T13:17:28Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00153,
  "epssPercentile": 0.04444,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-99051",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99051",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}