Junglewise Threat Intelligence

CVE-2026-31448: Linux Kernel infinite loop in ext4 file system extent mapping

CVE-2026-31448 · Severity: critical · CVSS 9.4 · Published 2026-04-22

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's ext4 file system can cause the system to enter an infinite loop during common file operations like creating directories. This occurs when the system fails to properly clean up internal data after a specific type of storage error, leading to memory corruption where two different parts of the system try to use the same storage block simultaneously. An exploit can lead to a total system hang (denial of service) and potential data corruption, impacting system availability and reliability.

Technical details

A flaw exists in the ext4 file system's 'mkdir/mknod' path within the 'ext4_ext_map_blocks()' function. When inserting a new extent into the extent tree fails (due to reasons other than ENOSPC or EDQUOT), the kernel reclaims the physical block but fails to remove the corresponding entry from the extent tree. This leads to a state where a physical block is double-referenced by both a directory and an xattr block. Consequently, 'ext4_xattr_block_set()' enters an infinite loop while holding the inode lock, resulting in a kernel hang and denial of service. The fix involves restricting the automatic freeing of blocks to only well-understood consistency errors (ENOSPC/EDQUOT) to prevent further metadata corruption when the filesystem state is already inconsistent.

Affected products

  • Linux Linux Kernel All versions prior to the fixed stable releases
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-06: other: Patch authored by Edward Adam Davis
  • 2026-04-22: disclosed: CVE published
  • 2026-07-14: advisory: Siemens product advisory updated

References

Related threats