CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size

Q: What level of access is required to trigger the issue?

The vulnerability has local attack vector and requires low privileges. Triggering it involves operating on an ext4 filesystem containing an inode marked for inline data storage.

Q: What conditions are needed for the crash to occur?

A file with the inline-data flag and a small initial size must be grown with truncate() beyond its actual inline capacity. A subsequent sendfile() write can then reach ext4_write_inline_data() with a write size larger than the inline capacity and trigger a kernel BUG_ON().

Q: How would an affected system behave?

The ext4 inode can enter an inconsistent state in which its inline-data flag remains set even though its file size exceeds inline storage capacity. The observable consequence described is a kernel crash through BUG_ON() during a later write attempt.

Published Apr 22, 2026

Updated

ext4: convert inline data to extents when truncate exceeds inline size

Affected Software

14 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.130.1-3

Patch available

Linux Linux kernel>=3.8<5.10.253

Linux Linux kernel>=5.11<5.15.203

Linux Linux kernel>=5.16<6.1.168

Linux Linux kernel>=6.2<6.6.131

Linux Linux kernel>=6.7<6.12.80

Linux Linux kernel>=6.13<6.18.21

Linux Linux kernel>=6.19<6.19.11

Linux Linux kernel=7.0-rc1

Linux Linux kernel=7.0-rc2

Linux Linux kernel=7.0-rc3

Linux Linux kernel=7.0-rc4

Linux Linux kernel=7.0-rc5

Event History

Apr 22, 2026

CVE Published

via MITRE·01:53 PM

Data Sourced

via MITRE·01:53 PM

Description

Data Sourced

via NVD·02:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Apr 23, 2026

Data Sourced

via Microsoft·08:04 AM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·08:04 AM

Affected Software

Updated

via Microsoft·08:04 AM

DescriptionSeverity

Frequently Asked Questions

What level of access is required to trigger the issue?

The vulnerability has local attack vector and requires low privileges. Triggering it involves operating on an ext4 filesystem containing an inode marked for inline data storage.

What conditions are needed for the crash to occur?

A file with the inline-data flag and a small initial size must be grown with truncate() beyond its actual inline capacity. A subsequent sendfile() write can then reach ext4_write_inline_data() with a write size larger than the inline capacity and trigger a kernel BUG_ON().

How would an affected system behave?

The ext4 inode can enter an inconsistent state in which its inline-data flag remains set even though its file size exceeds inline storage capacity. The observable consequence described is a kernel crash through BUG_ON() during a later write attempt.

CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size

Affected Software

Event History

Frequently Asked Questions

What level of access is required to trigger the issue?

What conditions are needed for the crash to occur?

How would an affected system behave?

Company

Resources

Contact

Frequently Asked Questions

What level of access is required to trigger the issue?

What conditions are needed for the crash to occur?

How would an affected system behave?