CVE-2026-93268: ext4: skip extra isize expansion during mount to prevent deadlock
In the Linux kernel, the following vulnerability has been resolved:
ext4: skip extra isize expansion during mount to prevent deadlock
ext4trytoexpandextraisize() is called from ext4markinodedirty() while holding an active jbd2 handle. During mount (!SBACTIVE), the expand path may move xattrs to external blocks and release eainodes via iput(). When !SBACTIVE, iput() calls writeinodenow() which acquires swritepagesrwsem, creating a circular lock dependency:
swritepagesrwsem --> jbd2handle --> xattrsem --> swritepagesrwsem
This can be triggered via:
ext4processorphan() -> ext4truncate() -> ext4markinodedirty() -> ext4trytoexpandextraisize()
or:
ext4evictinode() -> ext4markinodedirty() -> ext4trytoexpandextraisize()
Skip expansion when !SBACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.
Affected Software
Event History
Frequently Asked Questions
When can this deadlock be triggered?
It can occur during ext4 filesystem mount processing, before the superblock is active, through orphan processing and truncation or inode eviction paths that mark an inode dirty.
What condition creates the lock cycle?
The issue requires extra inode-size expansion during mount to move extended attributes to external blocks and release EA inodes via iput(). That path can acquire s_writepages_rwsem while a jbd2 handle and xattr semaphore are involved, creating a circular lock dependency.
What is the operational impact of the fix?
The fix skips extra isize expansion while the filesystem is not active during mount. Some affected inodes may not have their extra isize expanded at that time; e2fsck can resolve this later if necessary.