Executive brief
A vulnerability in the Linux kernel's EXT4 filesystem component can cause the entire system to crash (kernel panic) during the mounting process of a specifically configured or corrupted storage volume. This occurs because the system attempts to use internal counters before they have been properly set up. While this primarily affects system stability and availability, it could be used to cause a denial-of-service on affected servers or workstations.
Technical details
A NULL pointer dereference or uninitialized memory access (kernel panic) exists in the EXT4 filesystem driver due to improper initialization sequencing in `__ext4_fill_super`. When the `DOUBLE_CHECK` macro is enabled or specific filesystem corruption is encountered during mount, `mb_group_bb_bitmap_alloc()` validates block bitmaps. If validation fails, `ext4_mark_group_bitmap_corrupted()` attempts to update `sbi->s_freeclusters_counter`. However, `ext4_mb_init()` was previously called before `ext4_percpu_param_init()`, meaning the counter was not yet initialized. An attacker with the ability to mount a specially crafted EXT4 image could trigger a system-wide denial of service. The fix reorders the initialization so that per-CPU parameters are initialized before the multi-block allocator.
Affected products
- Linux Linux kernel 6.18.0-gba65a4e7120a-dirty
Timeline
- 2025-12-09: patched: Initial patch submitted by Baokun Li
- 2026-05-08: disclosed: CVE-2026-43288 published
References
- https://git.kernel.org/stable/c/0d5fcb063cdabb9aeaa8554b7fedad2092c4150e
- https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff
- https://git.kernel.org/stable/c/9e9fb259bcddf459a0168f4a964e979e500a68a5
- https://git.kernel.org/stable/c/aec095f3cc6cf209effd93278ce35be27db81d73
- https://git.kernel.org/stable/c/bf5b609524497c195f801cd5707252384aed8149