# CVE-2026-31448: Linux Kernel infinite loop in ext4 file system extent mapping

Source: https://junglewise.ai/threats/cve-2026-31448-linux-kernel-infinite-loop-in-ext4-file-system-extent-mapping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-31448 · Severity: critical · CVSS 9.4 · Published 2026-04-22

A vulnerability in the Linux kernel's ext4 file system can cause the system to enter an infinite loop during common file operations like creating directories. This occurs when the system fails to properly clean up internal data after a specific type of storage error, leading to memory corruption where two different parts of the system try to use the same storage block simultaneously. An exploit can lead to a total system hang (denial of service) and potential data corruption, impacting system availability and reliability.

Technologies: [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-31448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31448 being exploited in the wild.

**How severe is CVE-2026-31448?** Critical severity, with a CVSS score of 9.4, published 22 April 2026.

**Which products and versions are affected?** Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.

**Is there a fix for CVE-2026-31448?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31448 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-31448?** Check whether you run Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw exists in the ext4 file system's 'mkdir/mknod' path within the 'ext4_ext_map_blocks()' function. When inserting a new extent into the extent tree fails (due to reasons other than ENOSPC or EDQUOT), the kernel reclaims the physical block but fails to remove the corresponding entry from the extent tree. This leads to a state where a physical block is double-referenced by both a directory and an xattr block. Consequently, 'ext4_xattr_block_set()' enters an infinite loop while holding the inode lock, resulting in a kernel hang and denial of service. The fix involves restricting the automatic freeing of blocks to only well-understood consistency errors (ENOSPC/EDQUOT) to prevent further metadata corruption when the filesystem state is already inconsistent.

## Affected products

- Linux Linux Kernel All versions prior to the fixed stable releases
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

## Timeline

- 2026-03-06: other: Patch authored by Edward Adam Davis
- 2026-04-22: disclosed: CVE published
- 2026-07-14: advisory: Siemens product advisory updated

## References

- [https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412](https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412)
- [https://git.kernel.org/stable/c/416c86f30f91b4fb2642ef6b102596ca898f41a5](https://git.kernel.org/stable/c/416c86f30f91b4fb2642ef6b102596ca898f41a5)
- [https://git.kernel.org/stable/c/5422fe71d26d42af6c454ca9527faaad4e677d6c](https://git.kernel.org/stable/c/5422fe71d26d42af6c454ca9527faaad4e677d6c)
- [https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9](https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9)
- [https://git.kernel.org/stable/c/c66545e83a802c3851d9be27a41c0479dd29ff0c](https://git.kernel.org/stable/c/c66545e83a802c3851d9be27a41c0479dd29ff0c)
- [https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b](https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b)
- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Related threats

- [Linux Kernel denial of service in IPv6 tunneled traffic handling](https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling)
- [Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg)
- [Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node)
- [Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption)
- [Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe)