CVE-2026-89601
Description
A flaw was found in the Linux kernel's ext2 filesystem. This vulnerability occurs in the ext2_setsize() and ext2_xattr_set2() functions, where inode updates for IS_SYNC inodes may be lost. This happens because the sync_inode_metadata() function only processes inodes that are already marked as dirty, leading to potential data corruption or loss of metadata if the inode is not unconditionally marked dirty beforehand. A local attacker could potentially exploit this to cause data integrity issues.
Statement
This is a low-impact flaw in the Linux kernel's ext2 filesystem. In ext2_setsize() and ext2_xattr_set2(), inode metadata updates for inodes operating in synchronous mode (IS_SYNC) can be lost, because sync_inode_metadata() only writes back inodes that are already marked dirty. The consequence is limited to loss of data and metadata integrity on ext2 filesystems; the issue is triggerable only locally by a user with write access to an affected ext2 filesystem and does not lead to privilege escalation, information disclosure, or memory corruption.
Red Hat Enterprise Linux 7, 8, 9, and 10 are not affected because the vulnerable code is not present in their shipped kernels, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. OpenShift Container Platform 4 is not affected for the same vulnerable-code-not-present reason. OpenShift Container Platform 5.0 and 5.1 are affected through the RHEL CoreOS kernel, and fixes for those streams are deferred because this is a low-impact, local data-integrity issue in the legacy ext2 filesystem; the residual risk of deferral is limited to potential metadata-integrity loss for workloads that use synchronous ext2 mounts.
The CVE.org record assigns this flaw a CVSS 3.1 score of 8.8 with a network attack vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which does not match the verified technical nature of the flaw: there is no network attack vector, and the effect is confined to data integrity and availability of local ext2 filesystems. Red Hat assesses the severity of this flaw as CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
