Executive brief
The ext4 filesystem in the Linux kernel had a flaw that allowed encrypted files to be written unencrypted when the filesystem was mounted with the "dax=always" option. This caused data intended to be encrypted to bypass encryption entirely, exposing sensitive information. The vulnerability has been patched by reordering encryption flag initialization.
Technical details
A logic error in ext4's new inode creation process caused the DAX (Direct Access) flag (S_DAX) to be set on newly created encrypted files when the filesystem was mounted with "-o dax=always". The root cause was that ext4_set_inode_flags() was called before the EXT4_INODE_ENCRYPT flag was set, allowing S_DAX to be incorrectly enabled. A later commit (043546e46dc7) intended to clear S_DAX when encryption was set, but that mechanism was broken. The vulnerability allows data written to encrypted files to bypass encryption entirely. The fix reorders the flag initialization in __ext4_new_inode() to set EXT4_INODE_ENCRYPT earlier, and also prevents EXT4_STATE_MAY_INLINE_DATA from being set on new encrypted inodes. A local attacker with write access to an encrypted ext4 filesystem mounted with "dax=always" could exploit this to cause encrypted files to store plaintext data, exposing sensitive information.
Affected products
- Linux Linux kernel multiple versions with ext4 filesystem support (approximately Linux 5.0 and later, prior to the fix in commit da32af420d6d466e247c43ac0b829edeac7ae0ad)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched