CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size
ext4: convert inline data to extents when truncate exceeds inline size
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What level of access is required to trigger the issue?
The vulnerability has local attack vector and requires low privileges. Triggering it involves operating on an ext4 filesystem containing an inode marked for inline data storage.
What conditions are needed for the crash to occur?
A file with the inline-data flag and a small initial size must be grown with truncate() beyond its actual inline capacity. A subsequent sendfile() write can then reach ext4_write_inline_data() with a write size larger than the inline capacity and trigger a kernel BUG_ON().
How would an affected system behave?
The ext4 inode can enter an inconsistent state in which its inline-data flag remains set even though its file size exceeds inline storage capacity. The observable consequence described is a kernel crash through BUG_ON() during a later write attempt.