CVE-2026-92501
Description
A flaw was found in the Linux kernel's ext4 filesystem. A race condition exists during direct I/O (DIO) operations when the system falls back to buffered I/O. This unprotected timing window allows concurrent I/O operations to incorrectly invalidate cached data, leading to input/output (I/O) errors. A local user or process performing normal file operations could trigger this issue, potentially causing a Denial of Service (DoS) by making the filesystem unresponsive or corrupting data.
Statement
Red Hat has evaluated this issue as having Moderate severity because exploitation is restricted to authenticated local users and primarily leads to file write errors or denial of service, without granting elevated privileges or disclosing confidential information. The timing condition requires a specific sequence of concurrent asynchronous direct I/O and buffered fallback operations, which is rarely encountered under standard enterprise workloads on modern ext4 installations that utilize extent-based allocation. Consequently, the impact is confined to localized I/O failures for the affected processes or files rather than a complete system compromise.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
