Linux Kernel CVE-2026-99051

Exploitation requires local access to a system where fsverity is in use, and specifically the ability to trigger concurrent __fsverity_get_info() lookups against DIFFERENT fsverity-enabled inodes - the UAF does not arise for a single inode (whose fsverity_info is only freed at eviction or on enable failure), only across the shared rhashtable where entries are followed under rcu_read_lock() without synchronizing against fsverity_remove_info(). Limiting factors: no remote vector (AV:L), the attacker must already have a local foothold, and because the flaw is a race the attacker must win a narrow timing window between the rhashtable lookup and the freeing of the struct - so reliable triggering is harder than the supplied AC:L implies. Filesystems/deployments that do not enable fsverity are not exposed. The complete fix is the upstream change that RCU-delays freeing of struct fsverity_info; update to a kernel containing the referenced fix commits.

This is a kernel use-after-free (functionally CWE-416, though the input lists CWE as N/A) in the fsverity subsystem, rated 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The exploitation signals are modest and internally consistent: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and the only references are the two upstream fix commits on git.kernel.org plus an NVD pointer - so no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', i.e. patch-management priority rather than emergency. The CVSS attack vector is Local (AV:L), which correctly contradicts any assumption of remote reach - an attacker needs an existing local foothold. One point of tension: the description explicitly frames the bug as a concurrency/RCU race ('concurrent __fsverity_get_info() for *different* inodes'), which argues for a higher attack complexity than the AC:L in the supplied vector; a race window makes reliable exploitation harder than AC:L suggests. Net: a real local privilege-escalation/DoS risk worth patching on a normal cadence, not a widely-exploited emergency. Confidentiality 'Information Disclosure' is the only tag, but the vector claims full C:H/I:H/A:H - the tag understates the impact.

A local user with the ability to open files on an fsverity-enabled filesystem runs many threads that concurrently trigger fsverity_info lookups across different inodes. By racing a lookup against an inode eviction that frees a fsverity_info object before the RCU grace period, the attacker dereferences freed kernel memory, which can be groomed toward privilege escalation or a kernel crash. No public proof-of-concept is referenced, and winning the race reliably is non-trivial.