CVE-2026-31450

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset. The fast commit flush path can then pass this jinode to jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and may crash. Below is the crash I observe: ``` BUG: unable to handle page fault for address: 000000010beb47f4 PGD 110e51067 P4D 110e51067 PUD 0 Oops: Oop...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= a361293f5fedea0016a10599f409631a15d47ee7 < 2d2b648960147d078b000b9a7494017082024366, >= a361293f5fedea0016a10599f409631a15d47ee7 < e4325e84727e539c8597bd5b8491349f57f7fb17, >= a361293f5fedea0016a10599f409631a15d47ee7 < be54c0055407a73b60349c093c8ce621cb8fa232, >= a361293f5fedea0016a10599f409631a15d47ee7 < a070d5a872ffe0e0fe5c46eda6386140ded39adb, >= a361293f5fedea0016a10599f409631a15d47ee7 < e76bcb727e4874a2f9d0297f8e3f8eced89b0764, >= a361293f5fedea0016a10599f409631a15d47ee7 < 4855a59e21789c79f003a9b5f4135c95a7495c6b, >= a361293f5fedea0016a10599f409631a15d47ee7 < 33f486987af21531a7b18973d11795ede3da9ddd, >= a361293f5fedea0016a10599f409631a15d47ee7 < 1aec30021edd410b986c156f195f3d23959a9d11, >= 3.11, >= V3.1.6, >= V3.1.5, >= 3.11.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.134, >= 6.7 < 6.12.81, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 3.11, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.21, 6.19.11

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-476