Executive brief
The Linux kernel's ext4 filesystem fast commit feature had an incorrect wait/wake bit mapping on 64-bit systems. This caused synchronization calls to reference wrong memory locations when monitoring inode state changes during filesystem commits. The fix ensures proper coordination between threads managing filesystem transaction flushes, preventing potential inconsistencies or deadlocks.
Technical details
The vulnerability is a logic error in ext4's fast commit mechanism on 64-bit architectures. On 64-bit systems, ext4 dynamic inode states live in the upper half of i_flags with a +32 offset applied by ext4_test_inode_state(). However, the fast-commit wait/wake paths in fast_commit.c open-coded the wait queue key using raw EXT4_STATE_* values without applying this offset. This caused DEFINE_WAIT_BIT and bit_waitqueue calls for FC_COMMITTING and FC_FLUSHING_DATA states to reference incorrect bit positions, breaking the synchronization contract. The fix introduces helper functions ext4_inode_state_wait_word() and ext4_inode_state_wait_bit() to consistently apply the same offset logic used elsewhere, ensuring wait/wake operations target the correct inode state bits. The fix is available in commit 8b3bc93fee6771775243665a0cf31857d6659775.
Affected products
- Linux Linux Kernel Multiple versions (see fix commit for applicable ranges)
Timeline
- 2026-08-15: disclosed
- 2026-06-03: patched