Executive brief
The Linux kernel ext4 filesystem contains a bug in its journaled write handling that can cause the kernel to crash when writing to files with inline data stored in extended attributes. When a previous write fails to convert inline data to a regular extent due to disk space exhaustion, a subsequent write attempt triggers a kernel panic, affecting system stability and availability on any system using ext4 with the data=journal mount option.
Technical details
The vulnerability is a logic error in the ext4_journalled_write_end() function in fs/ext4/inode.c. When data=journal mount option is enabled, the function fails to check the EXT4_STATE_MAY_INLINE_DATA flag before calling ext4_write_inline_data_end(). If a prior inline-to-extent conversion fails (e.g., ENOSPC), the flag is cleared but EXT4_INODE_INLINE_DATA remains set. This inconsistent state causes ext4_write_begin() to skip xattr preparation, while ext4_journalled_write_end() still attempts the write, triggering a BUG_ON check on i_inline_size. The fix adds a flag check mirroring ext4_write_end() and ext4_da_write_end() behavior. Requires local filesystem access and the data=journal mount option. A patch is available upstream.
Affected products
- Linux Linux Kernel Affects multiple versions with ext4 inline data support; patched in mainline and stable trees
Timeline
- 2026-08-15: disclosed: CVE-2026-74308 published
- 2026-06-08: patched: Upstream patch commit ad09aa45965d3fafaf9963bc78109b73c0f9ac8d submitted
- 2026-07-24: other: Patch merged into stable trees