CVE-2026-31450: ext4: publish jinode after initialization
ext4: publish jinode after initialization
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In ext4_inode_attach_jinode(), initialize the jbd2_inode with jbd2_journal_init_jbd_inode() before publishing ei->jinode; publish it only after initialization using smp_wmb() followed by WRITE_ONCE().
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The race requires concurrent access to an ext4 inode while its journal inode is being attached. The described failure occurs when the fast commit flush path observes a non-NULL jinode before its i_vfs_inode field has been initialized and then calls jbd2_wait_inode_data().
What is the likely impact if the race is triggered?
The fast commit flush path can dereference i_vfs_inode->i_mapping while i_vfs_inode is unset, causing a null-pointer dereference and kernel crash. The supplied crash was observed during an fc_fsync_bench_ workload.
Which listed software is affected?
The affected software list includes the Linux kernel and Microsoft azl3 kernel 6.6.130.1-3. No broader version range is provided in the available data.