CVE-2026-43288

A flaw was found in the Linux kernel's ext4 filesystem. A local user can trigger a system panic, leading to a Denial of Service (DoS), by mounting a specially crafted ext4 filesystem with specific quota and project options. This occurs because a per-CPU counter is accessed before it is properly initialized during the block bitmap validation process.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is restricted to a local denial-of-service condition and requires the ability to mount a corrupted or specially formatted filesystem image. Under default enterprise configurations, unprivileged users cannot mount block devices, restricting attack vectors to administrative users or environments configured with automatic mounting of external media. The flaw triggers an unhandled kernel page fault during mount initialization, crashing the system without compromising data confidentiality or permitting privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.