CVE-2026-93268

ext4: skip extra isize expansion during mount to prevent deadlock

N/A
Published: September 24, 2026 at 03:52 PM UTC
Updated: October 19, 2026 at 10:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency: s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem This can be triggered via: ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() or: ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.7c8585c6fcaf2011de54c3592e80a634a2b9e1a7f
Vendor states this is fixed in 1dd4882dbdc8bfdf2182fa388883c143fac0902a (fixed)
Vendor states this is fixed in 2fb8ff81659a57c42bb7b49e8339a2be2a318ef8 (fixed)
Vendor states this is fixed in 41897f1bcf4ace5f1f28d0be784b6f4f0e929641 (fixed)
Vendor states this is fixed in 7461c60b9c6a839b13ad4c3490681a0cf5aa0637 (fixed)
Vendor states this is fixed in 7ace189b9ea79cf78df9c32b940ce12735f9459a (fixed)
Vendor states this is fixed in 7ba09330d9ea6e996228316719eae812d7e04983 (fixed)
Vendor states this is fixed in 9c3469377b1d8caba6bec6ef3c460810bbfb02cc (fixed)
Vendor states this is fixed in c5e6434cc55f30220b228be237bb666351f9f4dd (fixed)
Vendor states this is fixed in 4.7 (unaffected)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.52 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.6 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card