Executive brief
The Linux ext4 filesystem contains a race condition in how it handles inline data writes when concurrent operations convert data between different storage formats. A concurrent thread can cause the system to reference memory that was never allocated, leading to system crashes or data loss on affected servers.
Technical details
The vulnerability is a race condition in ext4's write_begin/write_end handlers related to inline data. The root cause is that ext4 was checking live inode state (ext4_has_inline_data) during write_end after a concurrent thread (e.g., ext4_page_mkwrite) could have converted inline data to extents between write_begin and write_end. When this conversion occurred, folio_buffers would be NULL, causing NULL pointer dereferences or data loss. The fix introduces an EXT4_WRITE_DATA_INLINE flag passed via fsdata to explicitly track the write state prepared in write_begin, eliminating reliance on live inode state checks. Additionally, a BUG_ON panic in ext4_write_inline_data_end is replaced with graceful error handling and retry logic to handle xattr lock race conditions.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-17: disclosed