Executive brief
The Linux kernel ext4 filesystem contains a flaw in its extended attribute (xattr) cache handling that can cause a task to spin indefinitely when dealing with corrupted filesystem metadata. This indefinite spinning can block concurrent directory operations like rmdir, potentially causing system responsiveness issues or hangs when administrators attempt file operations on affected systems.
Technical details
The vulnerability exists in ext4_xattr_block_set(), which retries cache entry selection when a cache entry's reference count is saturated (reaches EXT4_XATTR_REFCOUNT_MAX). The function returns to the mbcache lookup without marking the entry as ineligible for reuse, allowing it to select the same unusable entry indefinitely, creating a retry loop. The root cause is insufficient validation of on-disk xattr reference counts in corrupted filesystems. An attacker with filesystem write access or the ability to corrupt filesystem metadata can trigger this condition. The fix validates the untrusted on-disk count before incrementing it and clears the MBE_REUSABLE_B flag when the count is already saturated, ensuring that subsequent lookups skip the proven-unusable entry. A patch is available in the mainline Linux kernel.
Affected products
- Linux Linux kernel prior to fix
Timeline
- 2026-09-04: disclosed