In the Linux kernel the EXT4_IOC_MOVE_EXT ioctl performs a late validation of the donor file’s superblock, only after inode locks have been taken. If the donor file resides on a different filesystem, such as overlayfs, this late check can introduce a circular lock dependency that triggers a deadlock. This flaw, categorized as CWE‑833, allows an attacker to orchestrate concurrent filesystem operations that exploit the deadlock, potentially causing a system halt or prolonged unresponsiveness.

All Linux kernel releases that expose the EXT4_IOC_MOVE_EXT ioctl before the patch for CVE‑2026‑74307 is applied are affected. The vulnerability is present in kernel sources that do not include the newly committed superblock validation logic. Operating systems that ship with ext4 as a default filesystem or allow ext4 ioctl usage without verifying the donor file’s superblock are at risk, regardless of the distribution version. No specific vendor or version list is provided in the data.

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability is not included in the CISA KEV catalog. The description indicates that a deadlock occurs only when the EXT4_IOC_MOVE_EXT ioctl is invoked concurrently with a filesystem freeze, implying that both operations must take place on the same node. This inference is based on the presented scenario. The impact of a deadlock can be critical if it brings services to a halt. Whether the deadlock can be triggered remotely or only via local privileged access is not explicitly detailed in the input; the inference that a remote trigger would require an externally exposed ioctl interface is stated here. The EPSS score indicates that automated exploitation is currently unlikely.