CVE-2026-98941: ext4: don't enable large folios on encrypted inodes

Q: Which kernel versions are affected?

All kernels from v6.19 through v7.2 are affected. The fix is not needed in v7.3 because the relevant code was significantly refactored.

Q: What condition triggers the crash?

The ext4 encryption feature must be enabled after the filesystem is already mounted, bypassing the mount-time large-folio compatibility check. Writing encrypted data afterward can trigger a kernel NULL pointer dereference.

Q: Are filesystems mounted with encryption already enabled affected in the same way?

The described bypass applies when the encryption feature is enabled on an already mounted filesystem. At mount time, the existing check disables large folios when the encrypt feature is set.

Q: What can be done before applying the fix?

Do not enable the ext4 encryption feature on a mounted filesystem, and avoid encrypted writes on filesystems where that feature was enabled after mounting. The reported failure occurs in ext4 I/O completion work and presents as a kernel NULL pointer dereference.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't enable large folios on encrypted inodes

Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mounted filesystem circumvents that check, and writing encrypted data results in a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000028 Workqueue: ext4-rsv-conversion ext4endiorsvwork RIP: 0010:ext4finishbio+0xf7/0x3e0 Call Trace: ext4releaseioend+0x51/0x110 ext4endioend+0x4c/0xe0 ext4endiorsvwork+0xb3/0x100

Fix this by disabling large folios on encrypted inodes, as is already done for inodes that use data journaling.

This affects all kernels between v6.19 and v7.2, but it is not needed in v7.3, where the code was significantly refactored.

Affected Software

1 affected component

Linux Linux kernel>=6.19<=7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in v7.3
Configuration
Disable large folios on encrypted inodes.
Linux kernel ext4 large folios on encrypted inodes = disabled

Event History

Oct 23, 2026

CVE Published

via MITRE·12:12 PM

Data Sourced

via MITRE·12:12 PM

Description

Frequently Asked Questions

Which kernel versions are affected?

All kernels from v6.19 through v7.2 are affected. The fix is not needed in v7.3 because the relevant code was significantly refactored.

What condition triggers the crash?

The ext4 encryption feature must be enabled after the filesystem is already mounted, bypassing the mount-time large-folio compatibility check. Writing encrypted data afterward can trigger a kernel NULL pointer dereference.

Are filesystems mounted with encryption already enabled affected in the same way?

The described bypass applies when the encryption feature is enabled on an already mounted filesystem. At mount time, the existing check disables large folios when the encrypt feature is set.

What can be done before applying the fix?

Do not enable the ext4 encryption feature on a mounted filesystem, and avoid encrypted writes on filesystems where that feature was enabled after mounting. The reported failure occurs in ext4 I/O completion work and presents as a kernel NULL pointer dereference.

CVE-2026-98941: ext4: don't enable large folios on encrypted inodes

Affected Software

Remediation

Event History

Frequently Asked Questions

Which kernel versions are affected?

What condition triggers the crash?

Are filesystems mounted with encryption already enabled affected in the same way?

What can be done before applying the fix?

Company

Resources

Contact

Frequently Asked Questions

Which kernel versions are affected?

What condition triggers the crash?

Are filesystems mounted with encryption already enabled affected in the same way?

What can be done before applying the fix?