1. Home
  2. Vulnerabilities
  3. CVE-2026-74308
0.0
NA
CVE-2026-74308
ext4: fix kernel BUG in ext4_write_inline_data_end
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4_write_inline_data_end When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without checking if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode. If a previous attempt to convert the inline data to an extent failed (e.g. due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next call to ext4_write_begin() will not prepare the inline data xattr for writing, but ext4_journalled_write_end() will incorrectly attempt to write to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in ext4_write_inline_data() since i_inline_size was not expanded. Fix this by ensuring that ext4_journalled_write_end() only calls ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is set, mirroring the behavior of ext4_write_end() and ext4_da_write_end().

Details
INFO

Published Date :

Aug. 15, 2026, 6:22 a.m.

Last Modified :

Aug. 17, 2026, 6:19 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-74308 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Update the Linux kernel to fix an issue with ext4 inline data handling.
  • Apply the kernel patch for ext4 inline data.
  • Ensure ext4_journalled_write_end checks EXT4_STATE_MAY_INLINE_DATA.
  • Rebuild and install the updated kernel.
  • Reboot the system to load the new kernel.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-74308.

URL Resource
https://git.kernel.org/stable/c/0ae42b51607240990614e0843f0d3529aaff62cc
https://git.kernel.org/stable/c/260830a9a706f5d335398236fc788ce32f220de1
https://git.kernel.org/stable/c/9808ae9fae996afa942bd963a39c9b1cdeebd0bd
https://git.kernel.org/stable/c/ad09aa45965d3fafaf9963bc78109b73c0f9ac8d
https://git.kernel.org/stable/c/f00f5c0dd55319bc33b76f72c853bda0e0a32eda
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-74308 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-74308 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-74308 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-74308 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '260830a9a706f5d335398236fc788ce32f220de1', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '9808ae9fae996afa942bd963a39c9b1cdeebd0bd', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': 'f00f5c0dd55319bc33b76f72c853bda0e0a32eda', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '0ae42b51607240990614e0843f0d3529aaff62cc', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': 'ad09aa45965d3fafaf9963bc78109b73c0f9ac8d', 'versionType': 'git'}], 'programFiles': ['fs/ext4/inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ext4/inode.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '260830a9a706f5d335398236fc788ce32f220de1', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '9808ae9fae996afa942bd963a39c9b1cdeebd0bd', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': 'f00f5c0dd55319bc33b76f72c853bda0e0a32eda', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '0ae42b51607240990614e0843f0d3529aaff62cc', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': 'ad09aa45965d3fafaf9963bc78109b73c0f9ac8d', 'versionType': 'git'}], 'programFiles': ['fs/ext4/inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ext4/inode.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '260830a9a706f5d335398236fc788ce32f220de1', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '9808ae9fae996afa942bd963a39c9b1cdeebd0bd', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': 'f00f5c0dd55319bc33b76f72c853bda0e0a32eda', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': '0ae42b51607240990614e0843f0d3529aaff62cc', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb', 'lessThan': 'ad09aa45965d3fafaf9963bc78109b73c0f9ac8d', 'versionType': 'git'}], 'programFiles': ['fs/ext4/inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ext4/inode.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4_write_inline_data_end When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without checking if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode. If a previous attempt to convert the inline data to an extent failed (e.g. due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next call to ext4_write_begin() will not prepare the inline data xattr for writing, but ext4_journalled_write_end() will incorrectly attempt to write to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in ext4_write_inline_data() since i_inline_size was not expanded. Fix this by ensuring that ext4_journalled_write_end() only calls ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is set, mirroring the behavior of ext4_write_end() and ext4_da_write_end().
    Added Reference https://git.kernel.org/stable/c/0ae42b51607240990614e0843f0d3529aaff62cc
    Added Reference https://git.kernel.org/stable/c/260830a9a706f5d335398236fc788ce32f220de1
    Added Reference https://git.kernel.org/stable/c/9808ae9fae996afa942bd963a39c9b1cdeebd0bd
    Added Reference https://git.kernel.org/stable/c/ad09aa45965d3fafaf9963bc78109b73c0f9ac8d
    Added Reference https://git.kernel.org/stable/c/f00f5c0dd55319bc33b76f72c853bda0e0a32eda
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.