CVE-2026-31452

A flaw was found in the Linux kernel's ext4 filesystem. A local user could exploit a vulnerability where the truncate() function, when used to expand a file beyond its inline data capacity, fails to properly convert the file to extent-based storage. This inconsistency can lead to a kernel crash (BUG_ON) if a subsequent write operation, such as sendfile(), attempts to write data to the oversized inline file. This issue results in a denial of service.

This vulnerability is rated as Moderate impact because triggering the condition requires local unprivileged access and specifically affects ext4 filesystems formatted with inline data support, resulting in a denial of service rather than code execution or data leakage. In standard Red Hat Enterprise Linux deployments, XFS is the default filesystem, and ext4 volumes do not enable inline data by default. An unprivileged local attacker would need write privileges on a non-default ext4 mount to induce the kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.