CVE-2026-31450
published 2026-04-22CVE-2026-31450: In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode…
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.53%
41.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
ext4: publish jinode after initialization
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
allowing a reader to observe a non-NULL jinode with i_vfs_inode
still unset.
The fast commit flush path can then pass this jinode to
jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
may crash.
Below is the crash I observe:
```
BUG: unable to handle page fault for address: 000000010beb47f4
PGD 110e51067 P4D 110e51067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
RIP: 0010:xas_find_marked+0x3d/0x2e0
Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02
RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246
RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003
RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10
RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec
R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000
R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88
FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
filemap_get_folios_tag+0x87/0x2a0
__filemap_fdatawait_range+0x5f/0xd0
? srso_alias_return_thunk+0x5/0xfbef5
? __schedule+0x3e7/0x10c0
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? cap_safe_nice+0x37/0x70
? srso_al
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < 2d2b648960147d078b000b9a7494017082024366 | 2d2b648960147d078b000b9a7494017082024366 |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < e4325e84727e539c8597bd5b8491349f57f7fb17 | e4325e84727e539c8597bd5b8491349f57f7fb17 |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < be54c0055407a73b60349c093c8ce621cb8fa232 | be54c0055407a73b60349c093c8ce621cb8fa232 |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < a070d5a872ffe0e0fe5c46eda6386140ded39adb | a070d5a872ffe0e0fe5c46eda6386140ded39adb |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < e76bcb727e4874a2f9d0297f8e3f8eced89b0764 | e76bcb727e4874a2f9d0297f8e3f8eced89b0764 |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < 4855a59e21789c79f003a9b5f4135c95a7495c6b | 4855a59e21789c79f003a9b5f4135c95a7495c6b |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < 33f486987af21531a7b18973d11795ede3da9ddd | 33f486987af21531a7b18973d11795ede3da9ddd |
| linux | linux | >= a361293f5fedea0016a10599f409631a15d47ee7 < 1aec30021edd410b986c156f195f3d23959a9d11 | 1aec30021edd410b986c156f195f3d23959a9d11 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.11.1 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.2 < 6.6.134 | 6.6.134 |
| linux | linux_kernel | >= 6.7 < 6.12.81 | 6.12.81 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.19.10 ext4 ext4_inode_attach_jinode memory corruption (WID-SEC-2026-1252)
vuldb·2026-04-24
CVE-2026-31450 [CRITICAL] Linux Kernel up to 6.19.10 ext4 ext4_inode_attach_jinode memory corruption (WID-SEC-2026-1252)
A vulnerability classified as critical was found in Linux Kernel up to 6.19.10. This impacts the function ext4_inode_attach_jinode of the component ext4. Such manipulation leads to memory corruption.
This vulnerability is uniquely identified as CVE-2026-31450. The attack can only be initiated within the local network. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-fr68-gvh3-4qhv: In the Linux kernel, the following vulnerability has been resolved:
ext4: publish jinode after initialization
ext4_inode_attach_jinode() publishes e
ghsa_unreviewed·2026-04-22
CVE-2026-31450 GHSA-fr68-gvh3-4qhv: In the Linux kernel, the following vulnerability has been resolved:
ext4: publish jinode after initialization
ext4_inode_attach_jinode() publishes e
In the Linux kernel, the following vulnerability has been resolved:
ext4: publish jinode after initialization
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
allowing a reader to observe a non-NULL jinode with i_vfs_inode
still unset.
The fast commit flush path can then pass this jinode to
jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
may crash.
Below is the crash I observe:
```
BUG: unable to handle page fault for address: 000000010beb47f4
PGD 110e51067 P4D 110e51067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linu
Red Hat
kernel: ext4: publish jinode after initialization
vendor_redhat·2026-04-22·CVSS 7.0
CVE-2026-31450 [MEDIUM] kernel: ext4: publish jinode after initialization
kernel: ext4: publish jinode after initialization
No description is available for this CVE.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package: kernel (Red Hat Enterprise Linux 9) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 9) - Affected
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9dddhttps://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6bhttps://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adbhttps://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17https://git.kernel.org/stable/c/e76bcb727e4874a2f9d0297f8e3f8eced89b0764https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-04-22
Published