In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info()… (CVE-2026-99051)

The vulnerability in the Linux kernel's fsverity subsystem involves improper synchronization between __fsverity_get_info() and fsverity_remove_info(). __fsverity_get_info() calls rhashtable_lookup_fast() which uses rcu_read_lock() but does not synchronize directly with fsverity_remove_info(). While this is safe for the same inode, concurrent calls for different inodes can cause a use-after-free condition due to reliance on fsverity_info::rhash_head and fsverity_info::inode under rcu_read_lock() only. The fix delays freeing struct fsverity_info using RCU after it is removed from the rhashtable to prevent use-after-free.

This vulnerability can lead to use-after-free conditions in the kernel, potentially causing kernel crashes or memory corruption. However, no known exploits in the wild have been reported. The impact is limited to kernel stability and security related to fsverity operations on different inodes.

A fix has been implemented that introduces an RCU-delay in freeing struct fsverity_info after removal from the rhashtable. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.