Executive brief
A vulnerability in the Linux kernel's ext4 file system could allow a local user to crash the system. The issue occurs when multiple processes attempt to modify file attributes and data simultaneously, leading to a kernel panic. This results in a complete system outage and potential data loss for unsaved work.
Technical details
A race condition exists in fs/ext4/inline.c due to stale cached inline data size (i_inline_size). Between the initial size check in ext4_get_max_inline_size() and the acquisition of the xattr_sem lock, concurrent xattr operations can modify the actual available space. When ext4_update_inline_data() or ext4_create_inline_data() subsequently attempts to write using the stale, larger size value, it triggers a BUG_ON() in ext4_write_inline_data(). This is a local denial-of-service vulnerability. The fix involves recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring the xattr lock to ensure data consistency.
Affected products
- Linux Linux Kernel 6.12, 6.6, 6.1, 5.15, 5.10, 5.4, 4.19
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-10-20: disclosed: Initial patch submission
- 2025-12-16: advisory: CVE published
- 2026-01-11: patched: Final stable tree commits applied
References
- https://git.kernel.org/stable/c/1687a055a555347b002f406676a1aaae4668f242
- https://git.kernel.org/stable/c/210ac60a86a3ad2c76ae60e0dc71c34af6e7ea0b
- https://git.kernel.org/stable/c/43bf001f0fe4e59bba47c897505222f959f4a1cc
- https://git.kernel.org/stable/c/54ab81ae5f218452e64470cd8a8139bb5880fe2b
- https://git.kernel.org/stable/c/58df743faf21ceb1880f930aa5dd428e2a5e415d
- https://git.kernel.org/stable/c/892e1cf17555735e9d021ab036c36bc7b58b0e3b
- https://git.kernel.org/stable/c/89c2c41f0974e530b2d032c3695095aa0559adb1