CVE-2026-43288 - Vulnerability Details

- ext4: move ext4_percpu_param_init() before ext4_mb_init()

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: move ext4_percpu_param_init() before ext4_mb_init()

When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the
`DOUBLE_CHECK` macro defined, the following panic is triggered:

==================================================================
EXT4-fs error (device vdc): ext4_validate_block_bitmap:423:
comm mount: bg 0: bad block bitmap checksum
BUG: unable to handle page fault for address: ff110000fa2cc000
PGD 3e01067 P4D 3e02067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W
6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)
RIP: 0010:percpu_counter_add_batch+0x13/0xa0
Call Trace:
<TASK>
ext4_mark_group_bitmap_corrupted+0xcb/0xe0
ext4_validate_block_bitmap+0x2a1/0x2f0
ext4_read_block_bitmap+0x33/0x50
mb_group_bb_bitmap_alloc+0x33/0x80
ext4_mb_add_groupinfo+0x190/0x250
ext4_mb_init_backend+0x87/0x290
ext4_mb_init+0x456/0x640
__ext4_fill_super+0x1072/0x1680
ext4_fill_super+0xd3/0x280
get_tree_bdev_flags+0x132/0x1d0
vfs_get_tree+0x29/0xd0
vfs_cmd_create+0x59/0xe0
__do_sys_fsconfig+0x4f6/0x6b0
do_syscall_64+0x50/0x1f0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
==================================================================

This issue can be reproduced using the following commands:
mkfs.ext4 -F -q -b 1024 /dev/sda 5G
tune2fs -O quota,project /dev/sda
mount /dev/sda /tmp/test

With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads
and validates the block bitmap. When the validation fails,
ext4_mark_group_bitmap_corrupted() attempts to update
sbi->s_freeclusters_counter. However, this percpu_counter has not been
initialized yet at this point, which leads to the panic described above.

Fix this by moving the execution of ext4_percpu_param_init() to occur
before ext4_mb_init(), ensuring the per-CPU counters are initialized
before they are used.

Published: 2026-05-08

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An incorrect initialization order in the Linux ext4 filesystem code causes ext4_percpu_param_init() to run after ext4_mb_init(). When a block bitmap validation fails, the code attempts to update a per‑CPU counter that has not yet been initialized, leading to a panic and a system crash. This compromises availability by providing a denial‑of‑service vector. The flaw maps to uninitialized object usage (CWE-908).

Affected Systems

All Linux kernel builds containing the ext4 filesystem module before the patch that reorders the initialization calls are affected. Since no specific kernel version range is listed, any upstream release older than the fix may be impacted.

Risk and Exploitability

The vulnerability requires that an attacker be able to trigger ext4 block‑bitmap validation, typically by mounting an ext4 filesystem or executing filesystem tests. The likely attack vector is local: an attacker with sufficient privileges to mount or run tests can provoke the crash. No publicly available exploit is known and an EPSS score is not reported. The CVSS score of 5.5 indicates medium severity, and the vulnerability is not yet listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d5e03cbb0c88cd1be39f2adc37d602230045964b`	affected	< 0d5fcb063cdabb9aeaa8554b7fedad2092c4150e
`d5e03cbb0c88cd1be39f2adc37d602230045964b`	affected	< 9e9fb259bcddf459a0168f4a964e979e500a68a5
`d5e03cbb0c88cd1be39f2adc37d602230045964b`	affected	< bf5b609524497c195f801cd5707252384aed8149
`d5e03cbb0c88cd1be39f2adc37d602230045964b`	affected	< aec095f3cc6cf209effd93278ce35be27db81d73
`d5e03cbb0c88cd1be39f2adc37d602230045964b`	affected	< 270564513489d98b721a1e4a10017978d5213bff

Linux

affected

Version	Status	Constraints
`3.17`	affected	—
`0`	unaffected	< 3.17
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0d5fcb063cdabb9aeaa8554b7fedad2092c4150e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9e9fb259bcddf459a0168f4a964e979e500a68a5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bf5b609524497c195f801cd5707252384aed8149)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,aec095f3cc6cf209effd93278ce35be27db81d73)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,270564513489d98b721a1e4a10017978d5213bff)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch moving ext4_percpu_param_init() before ext4_mb_init().
Reboot the system after upgrading to ensure the updated kernel is active.
If upgrading is delayed, restrict mounting of ext4 filesystems or disable the DOUBLE_CHECK mechanism until the kernel is patched.

Generated by OpenCVE AI on May 9, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0d5fcb063cdabb9aeaa8554b7fedad2092c4150e
https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff
https://git.kernel.org/stable/c/9e9fb259bcddf459a0168f4a964e979e500a68a5
https://git.kernel.org/stable/c/aec095f3cc6cf209effd93278ce35be27db81d73
https://git.kernel.org/stable/c/bf5b609524497c195f801cd5707252384aed8149
https://lore.kernel.org/linux-cve-announce/2026050851-CVE-2026-43288-7514@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43288
https://www.cve.org/CVERecord?id=CVE-2026-43288

History

Sat, 09 May 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400 CWE-665

Sat, 09 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026050851-CVE-2026-43288-7514@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43288 https://www.cve.org/CVERecord?id=CVE-2026-43288
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 08 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400 CWE-665

Fri, 08 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: move ext4_percpu_param_init() before ext4_mb_init() When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the `DOUBLE_CHECK` macro defined, the following panic is triggered: ================================================================== EXT4-fs error (device vdc): ext4_validate_block_bitmap:423: comm mount: bg 0: bad block bitmap checksum BUG: unable to handle page fault for address: ff110000fa2cc000 PGD 3e01067 P4D 3e02067 PUD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none) RIP: 0010:percpu_counter_add_batch+0x13/0xa0 Call Trace: <TASK> ext4_mark_group_bitmap_corrupted+0xcb/0xe0 ext4_validate_block_bitmap+0x2a1/0x2f0 ext4_read_block_bitmap+0x33/0x50 mb_group_bb_bitmap_alloc+0x33/0x80 ext4_mb_add_groupinfo+0x190/0x250 ext4_mb_init_backend+0x87/0x290 ext4_mb_init+0x456/0x640 __ext4_fill_super+0x1072/0x1680 ext4_fill_super+0xd3/0x280 get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x29/0xd0 vfs_cmd_create+0x59/0xe0 __do_sys_fsconfig+0x4f6/0x6b0 do_syscall_64+0x50/0x1f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== This issue can be reproduced using the following commands: mkfs.ext4 -F -q -b 1024 /dev/sda 5G tune2fs -O quota,project /dev/sda mount /dev/sda /tmp/test With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads and validates the block bitmap. When the validation fails, ext4_mark_group_bitmap_corrupted() attempts to update sbi->s_freeclusters_counter. However, this percpu_counter has not been initialized yet at this point, which leads to the panic described above. Fix this by moving the execution of ext4_percpu_param_init() to occur before ext4_mb_init(), ensuring the per-CPU counters are initialized before they are used.
Title		ext4: move ext4_percpu_param_init() before ext4_mb_init()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d5fcb063cdabb9aeaa8554b7fedad2092c4150e https://git.kernel.org/stable/c/270564513489d98b721a1e4a10017978d5213bff https://git.kernel.org/stable/c/9e9fb259bcddf459a0168f4a964e979e500a68a5 https://git.kernel.org/stable/c/aec095f3cc6cf209effd93278ce35be27db81d73 https://git.kernel.org/stable/c/bf5b609524497c195f801cd5707252384aed8149

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-08T13:11:13.195Z

Updated: 2026-05-09T04:09:57.796Z

Reserved: 2026-05-01T14:12:55.999Z

Link: CVE-2026-43288

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-05-08T14:16:35.737

Modified: 2026-05-08T14:16:35.737

Link: CVE-2026-43288

Redhat

Severity : Moderate

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43288 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-09T05:00:10Z

Weaknesses

CWE-908

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object