CVE-2026-74358

A flaw was found in the ext4 filesystem component of the Linux kernel. On 64-bit systems, an incorrect mapping of wait/wake bits during fast commits could lead to unexpected behavior. This issue, if triggered, may result in system instability or data integrity problems.

A moderate-severity local denial of service flaw was found in the ext4 filesystem's fast commit implementation in the Linux kernel. On 64-bit systems, ext4 dynamic inode states are stored in the upper half of i_flags and are accessed with a corresponding +32 offset, but the fast-commit wait and wake paths open-coded their wait keys using the raw EXT4_STATE_* values. As a result, tasks could wait on the wrong synchronization key, potentially stalling fast-commit activity, blocking filesystem operations, and degrading system responsiveness. A local user able to perform file operations on an affected mounted ext4 filesystem could trigger this behavior; there is no impact to confidentiality or integrity. Red Hat Enterprise Linux 10.2.z and 10.3 (kernel) and Red Hat In-Vehicle OS 2 streams (kernel and kernel-ivos-qualcomm) are affected. For these streams the fix is deferred to a future update because the flaw is a local availability issue only, so the residual risk is limited to local denial of service. Earlier Red Hat Enterprise Linux versions, including RHEL 6, 7, 8, 9, and RHEL 10.0, are not affected because the fast commit rework that introduced this flawed bit mapping is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.