Executive brief
A vulnerability in the Linux kernel's ext4 filesystem could allow a local user to crash the system. The issue occurs when a file using a specific small-storage optimization is resized beyond its capacity, leading to internal data inconsistency. This can result in a system 'kernel panic' or crash, potentially disrupting operations or allowing further exploitation.
Technical details
A vulnerability exists in the ext4 filesystem driver where growing a file via truncate() does not clear the 'inline data' flag even if the new size exceeds inline capacity. When a subsequent write operation (such as via sendfile) occurs, the kernel hits a BUG_ON() in ext4_write_inline_data() because the write size exceeds the expected inline storage limits (~156 bytes). This is a logic error in ext4_setattr(). An attacker with local access can trigger this by mounting a crafted filesystem or manipulating specific file attributes to cause a Denial of Service (DoS). Patches have been released for multiple stable kernel branches to ensure ext4_convert_inline_data() is called during resizing.
Affected products
- Linux Linux Kernel All versions prior to the April 2026 patches
- Siemens业务 SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-02-07: other: Vulnerability reported by syzbot
- 2026-04-02: patched: Initial patches committed to stable trees
- 2026-04-22: advisory: CVE-2026-31452 published
References
- https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a
- https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf
- https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949
- https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669
- https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6
- https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4
- https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17