All vulnerabilities
CVE-2026-93268

Linux: ext4: skip extra isize expansion during mount to prevent deadlock

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in41897f1bcf4ace5f1f28d0be784b6f4f0e929641Also 9c3469377b1d8caba6bec6ef3c460810bbfb02cc, 1dd4882dbdc8bfdf2182fa388883c143fac0902a and 4 moreCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 41897f1bcf4ace5f1f28d0be784b6f4f0e929641LinuxCVE List
  • 9c3469377b1d8caba6bec6ef3c460810bbfb02ccLinuxCVE List
  • 1dd4882dbdc8bfdf2182fa388883c143fac0902aLinuxCVE List
  • 7ba09330d9ea6e996228316719eae812d7e04983LinuxCVE List
  • 7ace189b9ea79cf78df9c32b940ce12735f9459aLinuxCVE List
  • 2fb8ff81659a57c42bb7b49e8339a2be2a318ef8LinuxCVE List
Show all 7 fixed versions
  • 7461c60b9c6a839b13ad4c3490681a0cf5aa0637LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: skip extra isize expansion during mount to prevent deadlock

ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency:

s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem

This can be triggered via:

ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize()

or:

ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize()

Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.

Text from CVE List

Affected versions 18

  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 41897f1bcf4ace5f1f28d0be784b6f4f0e929641CVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 9c3469377b1d8caba6bec6ef3c460810bbfb02ccCVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 1dd4882dbdc8bfdf2182fa388883c143fac0902aCVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 7ba09330d9ea6e996228316719eae812d7e04983CVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before c5e6434cc55f30220b228be237bb666351f9f4ddCVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 7ace189b9ea79cf78df9c32b940ce12735f9459aCVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 2fb8ff81659a57c42bb7b49e8339a2be2a318ef8CVE List
  • Linuxaffected: c8585c6fcaf2011de54c3592e80a634a2b9e1a7f before 7461c60b9c6a839b13ad4c3490681a0cf5aa0637CVE List
  • Linuxaffected: 4.7CVE List
  • Linuxunaffected: all versions before 4.7CVE List
  • Linuxunaffected: 5.10.270 through 5.10.*CVE List
  • Linuxunaffected: 5.15.221 through 5.15.*CVE List
  • Linuxunaffected: 6.1.188 through 6.1.*CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8