CVE-2026-31450

A race was found in ext4: ext4_inode_attach_jinode() published ei->jinode before jbd2_journal_init_jbd_inode() finished initializing it, so concurrent readers could observe a non-NULL journal inode whose i_vfs_inode was still NULL. The fast-commit flush path then called jbd2_wait_inode_data() and faulted on i_mapping. Upstream publishes the pointer only after full initialization using WRITE_ONCE/READ_ONCE and a write memory barrier.

Red Hat acknowledges this ext4 fast-commit lifecycle bug as fixed upstream. Impact is a local crash/Denial-of-Service class defect reachable through fdatasync-heavy workloads with fast commit enabled. Supported products receive the fix through rebased kernels. Treat as kernel stability until product security completes exploitability review.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ext4 module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.