Executive brief
The Linux kernel's ext4 file system journal management (jbd2) contains a race condition that can cause data loss if the system loses power at a critical moment. Under specific timing conditions, a journal buffer can be incorrectly removed from the checkpoint list while still being modified by another transaction, causing uncommitted data to be lost after a power failure and file system corruption on restart.
Technical details
A use-after-free race condition exists in jbd2_journal_try_remove_checkpoint (fs/jbd2/checkpoint.c) where a journal head buffer (jh) can be prematurely removed from a checkpoint list even though it still belongs to an active transaction (jh->b_transaction is non-NULL). The vulnerability arises from insufficient state validation before buffer removal: the function checks if a buffer is dirty before removing it from the checkpoint, but does not verify that the buffer is no longer associated with a pending transaction. An attacker or race condition can trigger a sequence where: (1) a buffer is inserted into one transaction's checkpoint list, (2) the buffer is reassigned to a second transaction via do_get_write_access, (3) cache pressure causes jbd2_journal_try_remove_checkpoint to incorrectly remove it from the first transaction's list, and (4) a power loss occurs before the second transaction commits, permanently losing the data. The fix adds a check for jh->b_transaction before removal; if non-NULL, the function returns -EBUSY to prevent premature removal.
Affected products
- Linux Linux kernel Multiple versions (fix backported across 2.6.11 through 6.18+ stable branches)
Timeline
- 2023-07-14: disclosed: Original patch authored by Zhihao Cheng
- 2023-08-04: patched: Merged into mainline (commit 590a809ff743e7bd890ba5fb36bc38e20a36de53)
- 2023-09-19: patched: Backported to stable kernels via Greg Kroah-Hartman (commit 2298f2589903a8bc03061b54b31fd97985ab6529)
- 2025-10-01: advisory