CVE-2026-93268 - Vulnerability Details

- ext4: skip extra isize expansion during mount to prevent deadlock

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: skip extra isize expansion during mount to prevent deadlock

ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()
while holding an active jbd2 handle. During mount (!SB_ACTIVE), the
expand path may move xattrs to external blocks and release ea_inodes via
iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires
s_writepages_rwsem, creating a circular lock dependency:

s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem

This can be triggered via:

ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()
-> ext4_try_to_expand_extra_isize()

or:

ext4_evict_inode() -> ext4_mark_inode_dirty()
-> ext4_try_to_expand_extra_isize()

Skip expansion when !SB_ACTIVE. This is a minor loss of functionality
(extra isize won't grow for these inodes during mount), which e2fsck
can resolve later if needed.

Published: 2026-09-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s ext4 filesystem contains a bug that can create a circular lock dependency involving the write pages semaphore, the jbd2 handle, and the xattr semaphore. When the filesystem is mounted and if the inode is in a state that triggers a try‑to‑expand extra inode size routine, the routine may call functions that acquire these locks in an order that leads to a deadlock. The result is a halt of the mount or kernel activity, effectively causing a denial of service.

Affected Systems

The issue affects the Linux kernel’s ext4 filesystem implementation. No specific kernel versions are listed, so all current releases prior to the patch are potentially impacted.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA's KEV catalogue. Based on the description, the likely attack vector is local, as the deadlock is triggered during mount operations or inode eviction. The main risk is a system hang or unresponsive kernel state until a reboot or manual intervention occurs.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 41897f1bcf4ace5f1f28d0be784b6f4f0e929641
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 9c3469377b1d8caba6bec6ef3c460810bbfb02cc
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 1dd4882dbdc8bfdf2182fa388883c143fac0902a
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 7ba09330d9ea6e996228316719eae812d7e04983
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< c5e6434cc55f30220b228be237bb666351f9f4dd
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 7ace189b9ea79cf78df9c32b940ce12735f9459a
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 2fb8ff81659a57c42bb7b49e8339a2be2a318ef8
`c8585c6fcaf2011de54c3592e80a634a2b9e1a7f`	affected	< 7461c60b9c6a839b13ad4c3490681a0cf5aa0637

Linux

affected

Version	Status	Constraints
`4.7`	affected	—
`0`	unaffected	< 4.7
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,41897f1bcf4ace5f1f28d0be784b6f4f0e929641)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,9c3469377b1d8caba6bec6ef3c460810bbfb02cc)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,1dd4882dbdc8bfdf2182fa388883c143fac0902a)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,7ba09330d9ea6e996228316719eae812d7e04983)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,7ace189b9ea79cf78df9c32b940ce12735f9459a)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,c5e6434cc55f30220b228be237bb666351f9f4dd)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,2fb8ff81659a57c42bb7b49e8339a2be2a318ef8)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,7461c60b9c6a839b13ad4c3490681a0cf5aa0637)`	affected	code_commit	—
`[c8585c6fcaf2011de54c3592e80a634a2b9e1a7f,7461c60b9c6a839b13ad4c3490681a0cf5aa0637)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4.7,4.7]`	affected	generic	—
`[0,4.7)`	unaffected	generic	—
`[5.10.270,5.10.*]`	unaffected	generic	—
`[5.15.221,5.15.*]`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—
`[7.2.6,7.2.*]`	unaffected	generic	—
`[6.18.52,6.18.*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[5.15.221,5.15.*]`	unaffected	generic	—
`[5.10.270,5.10.*]`	unaffected	generic	—
`[0,4.7)`	unaffected	generic	—
`[4.7,4.7]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that skips extra isize expansion during mount to avoid deadlock (identified by commit 1dd4882dbdc8bfdf2182fa388883c143fac0902a).
Reboot the system to load the updated kernel and apply the patch.
Run e2fsck on ext4 filesystems if new inodes were created during the period when the deadlock could occur, to recover any missing isize expansion.

Generated by OpenCVE AI on October 1, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93268.mbox
https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a
https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8
https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641
https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637
https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a
https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983
https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc
https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd
https://nvd.nist.gov/vuln/detail/CVE-2026-93268
https://www.cve.org/CVERecord?id=CVE-2026-93268

History

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93268.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-93268 https://www.cve.org/CVERecord?id=CVE-2026-93268
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Thu, 24 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency: s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem This can be triggered via: ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() or: ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.
Title		ext4: skip extra isize expansion during mount to prevent deadlock
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8 https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641 https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637 https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983 https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:52:07.310Z

Updated: 2026-09-24T15:52:07.310Z

Reserved: 2026-09-17T16:02:15.097Z

Link: CVE-2026-93268

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:23.730

Modified: 2026-09-24T16:17:23.730

Link: CVE-2026-93268

Redhat

Severity : Low

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-93268 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T21:15:09Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object