CVE-2026-31448

A flaw was found in the Linux kernel's ext4 filesystem. When creating a directory or node, if an extent insertion fails, the system may not properly clear residual data. This can lead to a situation where both directory and extended attribute (xattr) blocks simultaneously use the same memory buffer, causing an infinite loop. A local attacker could exploit this to trigger a system hang, resulting in a Denial of Service (DoS). Additionally, this flaw could lead to metadata corruption.

This defect concerns ext4 metadata handling on error paths during mkdir/mknod operations and can wedge inode locks or corrupt accounting. Red Hat aligns severity with upstream MODERATE impact focused on availability and filesystem consistency. Customers should install corrected ext4 code when errata ships. Workloads that cannot avoid ext4 should prioritize patching over operational workarounds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ext4 module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.