Executive brief
A vulnerability exists in the Linux kernel's ext4 file system, which is widely used for data storage. A flaw in how the system handles file updates can cause the operating system to crash unexpectedly. This could lead to service interruptions or system instability in environments using affected versions of the Linux kernel or integrated industrial controllers like certain Siemens SIMATIC CPUs.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in the ext4 file system component of the Linux kernel. The function ext4_inode_attach_jinode() was found to publish the 'ei->jinode' pointer to concurrent users before completing its initialization via jbd2_journal_init_jbd_inode(). This race condition allows the fast commit flush path to observe a non-NULL jinode while the internal 'i_vfs_inode' is still unset. When jbd2_wait_inode_data() subsequently attempts to dereference the unset mapping, a kernel panic occurs. The fix involves reordering the initialization and using memory barriers (smp_wmb) and atomic accessors (WRITE_ONCE/READ_ONCE) to ensure the pointer is only visible once fully initialized.
Affected products
- Linux Linux Kernel 6.18.0-00764-g795a690c06a5
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-02-25: disclosed: Initial patch authored by Li Chen
- 2026-04-22: advisory: CVE published to NVD
- 2026-07-14: advisory: Siemens product advisory updated
References
- https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11
- https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366
- https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9ddd
- https://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6b
- https://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adb
- https://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232
- https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17