Executive brief
A vulnerability in the Linux kernel's EXT4 filesystem could lead to data loss or system instability. When the system attempts to save data to a disk section that is already known to be corrupted, it may fail to find an alternative healthy location, resulting in failed write operations. This primarily impacts system availability and the integrity of stored data.
Technical details
A logic error in the EXT4 multi-block allocator (mballoc) prevents the system from skipping corrupted block groups during allocation. Specifically, in 'ext4_mb_find_by_goal', if 'ext4_mb_load_buddy' returns an error due to a corrupted bitmap, the allocator may fail the entire request instead of falling back to other groups. This occurs because recent changes to bitmap read routines return real error codes that bypass previous corruption-handling logic. An attacker with local access could potentially trigger this condition to cause a denial of service or data loss. Patches have been released across multiple stable kernel branches to ensure the allocator checks for corruption flags when 'ext4_mb_load_buddy' fails.
Affected products
- Linux Linux Kernel 3.12 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-02: other: Patch authored
- 2026-05-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0b84571c886719823d537f05f4f07cad6357c4b7
- https://git.kernel.org/stable/c/1895f7904be71c48f1e6f338b28f24dabd6b8aeb
- https://git.kernel.org/stable/c/1c0d7c4cde38a887c6d74e0c89ddb25226943c78
- https://git.kernel.org/stable/c/2d31a5073f86a177edf44015e0dedb0c47cfd6d8
- https://git.kernel.org/stable/c/46066e3a06647c5b186cc6334409722622d05c44
- https://git.kernel.org/stable/c/9370207b36d26e45a8c8ef0500706d37036edd6b
- https://git.kernel.org/stable/c/fea6b2e250ff48f10d166011b57a8516ae5438c9