CVE-2026-72225
Description
A flaw was found in the Linux kernel's jbd2 journaling layer. An integer underflow vulnerability in the jbd2_journal_initialize_fast_commit() function occurs when validating journal capacity. This underflow can corrupt critical journal metadata, such as j_last, j_fc_first, and j_free, leading to a journal abort. This issue can result in a Denial of Service (DoS) for the affected system.
Statement
Red Hat has rated this vulnerability as Low impact because exploitation requires the ability to mount a maliciously crafted filesystem or directly manipulate raw block device data, privileges restricted to administrative users in standard configurations. The fast commit journal capability involved in this underflow is an optional feature that is not enabled by default on standard ext4 filesystems. Furthermore, triggering the condition causes an internal journal abort resulting in a filesystem-level denial of service rather than code execution or broader system compromise.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
