CVE-2026-93268

A flaw was found in the Linux kernel's ext4 file system. When mounting a file system, expanding extended attribute storage while holding an active journal lock can create a circular locking dependency. A local user capable of mounting or triggering file system recovery operations could exploit this flaw to cause a system deadlock, resulting in a Denial of Service (DoS).

A low impact denial of service flaw was found in the Linux kernel ext4 file system code shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. During an ext4 file system mount, expanding extended attribute storage (extra inode size expansion) while an active jbd2 journal handle is held can create a circular locking dependency between s_writepages_rwsem, the jbd2 handle, and xattr_sem, for example during orphan inode processing or inode eviction triggered at mount time. A local user able to mount a specially prepared ext4 file system or to trigger file system recovery operations could exploit this flaw to cause a system deadlock, resulting in a denial of service; no impact to confidentiality or integrity is supported by the evidence. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that code stream. Because the flaw is rated low impact, can only be triggered locally with the privileges needed to mount a file system or trigger recovery, and affects only system availability, fixes for the affected products have been deferred to future scheduled maintenance updates; the residual risk is a local denial of service through a mount-time deadlock. Although the Red Hat CVSS 3.1 base score for this flaw is 5.5 (Moderate), Red Hat's overall impact rating is Low, reflecting the local and privileged attack requirements and the availability-only consequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.