CVE-2026-31450: ext4: publish jinode after initialization
ext4: publish jinode after initialization
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel so the bugfix is included: ext4 must initialize the jbd2_inode before calling jbd2_journal_init_jbd_inode(), and publish ei->jinode only after initialization using smp_wmb() and WRITE_ONCE(), so readers cannot observe a non-NULL ei->jinode with i_vfs_inode not yet initialized.
Linux kernel (ext4/jbd2 fast commit path) Initialize ext4 jbd2 inode pointer (ei->jinode) before jbd2_journal_init_jbd_inode; publish using smp_wmb()/WRITE_ONCE = applied via kernel fix
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The race requires concurrent access to an ext4 inode while its journal inode is being attached. The described failure occurs when the fast commit flush path observes a non-NULL jinode before its i_vfs_inode field has been initialized and then calls jbd2_wait_inode_data().
What is the likely impact if the race is triggered?
The fast commit flush path can dereference i_vfs_inode->i_mapping while i_vfs_inode is unset, causing a null-pointer dereference and kernel crash. The supplied crash was observed during an fc_fsync_bench_ workload.
Which listed software is affected?
The affected software list includes the Linux kernel and Microsoft azl3 kernel 6.6.130.1-3. No broader version range is provided in the available data.