CVE-2026-31450
Description
A race was found in ext4: ext4_inode_attach_jinode() published ei->jinode before jbd2_journal_init_jbd_inode() finished initializing it, so concurrent readers could observe a non-NULL journal inode whose i_vfs_inode was still NULL. The fast-commit flush path then called jbd2_wait_inode_data() and faulted on i_mapping. Upstream publishes the pointer only after full initialization using WRITE_ONCE/READ_ONCE and a write memory barrier.
Statement
Red Hat acknowledges this ext4 fast-commit lifecycle bug as fixed upstream. Impact is a local crash/Denial-of-Service class defect reachable through fdatasync-heavy workloads with fast commit enabled. Supported products receive the fix through rebased kernels. Treat as kernel stability until product security completes exploitability review.
Mitigation
To mitigate this issue, prevent the ext4 module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
