CVE-2026-89601: ext2: Fix lost inode updates for IS_SYNC inodes
In the Linux kernel, the following vulnerability has been resolved:
ext2: Fix lost inode updates for ISSYNC inodes
ext2setsize() and ext2xattrset2() had a construct like:
if (ISSYNC(inode)) { syncinodemetadata(inode, 1); } else { markinodedirty(inode); }
which leads to lost inode updates for ISSYNC inodes because syncinodemetadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the inode dirty and then call syncinodemetadata().
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using the ext2 filesystem are relevant. The issue specifically affects inode size and extended-attribute update paths for inodes marked IS_SYNC.
What condition triggers the lost updates?
An inode must be marked IS_SYNC, and an operation must update it through ext2_setsize() or ext2_xattr_set2(). In the affected logic, metadata synchronization could be attempted before the inode was marked dirty, allowing the update to be lost.
How can I mitigate the issue if I cannot apply the fix immediately?
The provided information does not identify a configuration workaround. Reducing or avoiding use of ext2 filesystems and avoiding affected IS_SYNC inode update operations may reduce exposure, but no validated mitigation is provided.