---
id: CVE-2026-90318
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fat: release buffer head after rebuilding parent

  fat_scan_logstart() leaves the matching directory entry's buffer head in
  sinfo.bh for the caller to release, just like…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fat: release buffer head after rebuilding parent

  fat_scan_logstart() leaves the matching directory entry's buffer head in
  sinfo.bh for the caller to release, just like…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    5e44b6944e11fd6647f028219ad0be4e85e9acee
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    d2a86329152c69a6200c15b2bf618755f8563826
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    0f18d712ba9c980e05b7e33a27cde4fe3ed2d393
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    e38587d98d1ceac608420052c0cdd901d25878f3
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    c6a67aa438179cad40f8ae45469e304338d65c0a
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    571ea4263d69df1b48578e4314a828ecd0604755
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    7565e44507634514e3e1899d3acad3de43f7a2c1
  - >-
    Linux >= f1e6fb0ab451dae8523fbb8c119a653b2730e938 <
    83e98dbf19ab64e8528e101e20f8d50e1aaa68a8
  - Linux 3.10
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:29.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90318'
references:
  - url: 'https://git.kernel.org/stable/c/0f18d712ba9c980e05b7e33a27cde4fe3ed2d393'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/571ea4263d69df1b48578e4314a828ecd0604755'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5e44b6944e11fd6647f028219ad0be4e85e9acee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7565e44507634514e3e1899d3acad3de43f7a2c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/83e98dbf19ab64e8528e101e20f8d50e1aaa68a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c6a67aa438179cad40f8ae45469e304338d65c0a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d2a86329152c69a6200c15b2bf618755f8563826'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e38587d98d1ceac608420052c0cdd901d25878f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.824Z'
epss: 0.0021
epssPercentile: 0.11534
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fat: release buffer head after rebuilding parent

fat_scan_logstart() leaves the matching directory entry's buffer head in
sinfo.bh for the caller to release, just like fat_scan().

fat_rebuild_parent() uses the directory entry to rebuild the parent inode
for the nostale_ro NFS export path, but does not release sinfo.bh after a
successful scan.  Release it once fat_build_inode() has consumed the
directory entry data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.