CVE-2026-45920: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-r62x-r6m8-28mx
Share
CVSS 7.8
CWE-415
Published
Advisory Summary

CVE-2026-45920 is a HIGH (CVSS 7.8) security vulnerability vulnerability (CWE-415: Double Free) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product calls free() twice on the same memory address.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-45920 at a Glance

CVE Identifier CVE-2026-45920
GHSA Identifier GHSA-r62x-r6m8-28mx
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification CWE-415: Double Free
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-45920

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-45920, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-415: Double Free, where the product calls free() twice on the same memory address. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure.

References

NVD — CVE-2026-45920 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45920
git.kernel.org/stable/c/3924aea2c3... WEB
https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f
git.kernel.org/stable/c/523d5a4df3... WEB
https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d
git.kernel.org/stable/c/55576fa147... WEB
https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20
git.kernel.org/stable/c/61e372122b... WEB
https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897
git.kernel.org/stable/c/81982a1140... WEB
https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128
git.kernel.org/stable/c/94a8cea54c... WEB
https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3
git.kernel.org/stable/c/ca408af085... WEB
https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95
git.kernel.org/stable/c/dbc4e10619... WEB
https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769

Frequently Asked Questions

What is CVE-2026-45920?
CVE-2026-45920 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-415: Double Free.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-45920?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-45920?
CVE-2026-45920 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-45920?
CVE-2026-45920 is classified under CWE-415: Double Free (The product calls free() twice on the same memory address.).
How can I check Maven dependencies for CVE-2026-45920?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r62x-r6m8-28mx",
  "modified" : "2026-06-24T18:32:28Z",
  "published" : "2026-05-27T15:33:16Z",
  "aliases" : [ "CVE-2026-45920" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n  WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar->len out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45920"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-415" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-05-27T14:17:06Z"
  }
}