CVE-2026-93268
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency: s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem This can be triggered via: ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() or: ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-24 16:17:23.730000
Last modified
2026-10-19 10:17:18.230000
View original CVE JSON
{
"id": "CVE-2026-93268",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-24T16:17:23.730",
"lastModified": "2026-10-19T10:17:18.230",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: skip extra isize expansion during mount to prevent deadlock\n\next4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()\nwhile holding an active jbd2 handle. During mount (!SB_ACTIVE), the\nexpand path may move xattrs to external blocks and release ea_inodes via\niput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires\ns_writepages_rwsem, creating a circular lock dependency:\n\n s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem\n\nThis can be triggered via:\n\n ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()\n -> ext4_try_to_expand_extra_isize()\n\nor:\n\n ext4_evict_inode() -> ext4_mark_inode_dirty()\n -> ext4_try_to_expand_extra_isize()\n\nSkip expansion when !SB_ACTIVE. This is a minor loss of functionality\n(extra isize won't grow for these inodes during mount), which e2fsck\ncan resolve later if needed."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "41897f1bcf4ace5f1f28d0be784b6f4f0e929641",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "9c3469377b1d8caba6bec6ef3c460810bbfb02cc",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "1dd4882dbdc8bfdf2182fa388883c143fac0902a",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "7ba09330d9ea6e996228316719eae812d7e04983",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "c5e6434cc55f30220b228be237bb666351f9f4dd",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "7ace189b9ea79cf78df9c32b940ce12735f9459a",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "2fb8ff81659a57c42bb7b49e8339a2be2a318ef8",
"versionType": "git",
"status": "affected"
},
{
"version": "c8585c6fcaf2011de54c3592e80a634a2b9e1a7f",
"lessThan": "7461c60b9c6a839b13ad4c3490681a0cf5aa0637",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.7",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.7",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.270",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.110",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.52",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.6",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}