Executive brief
The Linux kernel's ext2 filesystem contained a bug where write errors during synchronous file operations were silently discarded, causing applications to incorrectly believe data was safely persisted to disk when it was not. This could lead to silent data loss or corruption if applications rely on sync guarantees for critical data.
Technical details
The vulnerability is an ignored return value error in the ext2_dio_write_iter() function in fs/ext2/file.c. When handling direct I/O writes on O_SYNC or O_DSYNC files, the function calls generic_write_sync() to ensure data is flushed to storage, but discards any error return value instead of propagating it to userspace. An attacker with local filesystem access could craft writes that fail synchronization (e.g., via I/O errors) and observe the write(2) syscall returning success despite the sync failure. The fix, already used in ext4/xfs/f2fs and ext2's own DAX code path, assigns the return value: ret = generic_write_sync(iocb, ret). The vulnerability affects all Linux kernel versions supporting ext2 direct I/O with the iomap backend (introduced by commit fb5de4358e1a).
Affected products
- Linux Linux kernel All versions with ext2 direct-io iomap support
Timeline
- 2026-05-30: disclosed: Vulnerability discovered and patch submitted by Danila Chernetsov
- 2026-07-24: patched: Fix merged into stable kernel trees