In the Linux kernel’s ext4 file system, a failure to cleanly remove a failed extent insertion leads to an infinite loop within ext4_xattr_block_set. The loop continually attempts to mark the same buffer head as inserted, preventing the inode lock from being released. As a result, tasks that try to create or manipulate directories hang for extended periods, effectively disabling filesystem operations on affected paths. The vulnerability triggers a denial of service, but does not leak data, execute code, or provide privilege escalation.

All Linux kernel builds that compile ext4 and have not incorporated the patches referenced in the commit logs are vulnerable. The fix is present in the commits cited in the advisory (e.g., 3a7667595bcad84da53fc156a418e110267c3412). Administrators should verify that their current kernel image contains these changes, or plan to upgrade to a kernel release that includes the updated ext4 code.

The flaw requires write access to the filesystem to trigger the problematic extent logic, limiting exploitation to local users with directory creation rights. The CVSS score of 9.4 indicates critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Although exploitation attempts are unlikely at present, the blocking behavior can severely impact operations, warranting prompt remediation.