UBUNTU-CVE-2026-89601: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for ISSYNC inodes ext2setsize() and ext2xattrset2() had a construct like: if (ISSYNC(inode)) { syncinodemetadata(inode, 1); } else { markinodedirty(inode); } which leads to lost inode updates for ISSYNC inodes because syncinodemetadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the inode dirty and then call syncinodemetadata().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ext2_setsize() and ext2_xattr_set2(), unconditionally call mark_inode_dirty(inode) before calling sync_inode_metadata(inode, 1), including for IS_SYNC inodes.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector is local and requires low privileges. No user interaction is required, and the attack complexity is rated low.
What is the expected security impact?
The reported impact is limited to low integrity impact. Confidentiality and availability impacts are rated as none.
Which Ubuntu kernel package families are listed as affected?
The listed package families are linux, linux-fips, linux-aws, linux-azure, linux-aws-fips, linux-azure-fips, linux-gcp, and linux-gcp-fips.