Vulnerability-Lookup

GHSA-JJVW-QJPR-6RPV

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-24 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't enable large folios on encrypted inodes

Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mounted filesystem circumvents that check, and writing encrypted data results in a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000028 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work RIP: 0010:ext4_finish_bio+0xf7/0x3e0 Call Trace: ext4_release_io_end+0x51/0x110 ext4_end_io_end+0x4c/0xe0 ext4_end_io_rsv_work+0xb3/0x100

Fix this by disabling large folios on encrypted inodes, as is already done for inodes that use data journaling.

This affects all kernels between v6.19 and v7.2, but it is not needed in v7.3, where the code was significantly refactored.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98941"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0027t enable large folios on encrypted inodes\n\nCommit 709f0f1f1bf5 (\"ext4: add checks for large folio\nincompatibilities when BS \u003e PS\") disables large folios at mount time\nif the \"encrypt\" feature is set. However, enabling that feature on a\nmounted filesystem circumvents that check, and writing encrypted data\nresults in a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work\n  RIP: 0010:ext4_finish_bio+0xf7/0x3e0\n  Call Trace:\n   ext4_release_io_end+0x51/0x110\n   ext4_end_io_end+0x4c/0xe0\n   ext4_end_io_rsv_work+0xb3/0x100\n\nFix this by disabling large folios on encrypted inodes, as is\nalready done for inodes that use data journaling.\n\nThis affects all kernels between v6.19 and v7.2, but it is not needed\nin v7.3, where the code was significantly refactored.",
  "id": "GHSA-jjvw-qjpr-6rpv",
  "modified": "2026-10-24T15:32:47Z",
  "published": "2026-10-23T15:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98941"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/40554d1221e3d2ff2e0d192b74a05d89eb3620e7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-98941 (GCVE-0-2026-98941)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:12 – Updated: 2026-10-24 14:09

Title

ext4: don't enable large folios on encrypted inodes

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mounted filesystem circumvents that check, and writing encrypted data results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work RIP: 0010:ext4_finish_bio+0xf7/0x3e0 Call Trace: ext4_release_io_end+0x51/0x110 ext4_end_io_end+0x4c/0xe0 ext4_end_io_rsv_work+0xb3/0x100 Fix this by disabling large folios on encrypted inodes, as is already done for inodes that use data journaling. This affects all kernels between v6.19 and v7.2, but it is not needed in v7.3, where the code was significantly refactored.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7067 records in the last 180 days details

References

1 reference

URL	Tags
https://git.kernel.org/stable/c/40554d1221e3d2ff2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 709f0f1f1bf5ca62a000084e5446ca6b57c8678c , < 40554d1221e3d2ff2e0d192b74a05d89eb3620e7 (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40554d1221e3d2ff2e0d192b74a05d89eb3620e7",
              "status": "affected",
              "version": "709f0f1f1bf5ca62a000084e5446ca6b57c8678c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0027t enable large folios on encrypted inodes\n\nCommit 709f0f1f1bf5 (\"ext4: add checks for large folio\nincompatibilities when BS \u003e PS\") disables large folios at mount time\nif the \"encrypt\" feature is set. However, enabling that feature on a\nmounted filesystem circumvents that check, and writing encrypted data\nresults in a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work\n  RIP: 0010:ext4_finish_bio+0xf7/0x3e0\n  Call Trace:\n   ext4_release_io_end+0x51/0x110\n   ext4_end_io_end+0x4c/0xe0\n   ext4_end_io_rsv_work+0xb3/0x100\n\nFix this by disabling large folios on encrypted inodes, as is\nalready done for inodes that use data journaling.\n\nThis affects all kernels between v6.19 and v7.2, but it is not needed\nin v7.3, where the code was significantly refactored."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged owner can create an encrypted file and use write(2) through ext4_file_write_iter() and generic_perform_write(); __ext4_new_inode() reaches the patched ext4_set_inode_mapping_order(), which wrongly permits a large folio. No remote protocol supplies the triggering data.\nAC:H - The vulnerable state requires EXT4_IOC_SET_TUNE_SB_PARAM to enable EXT4_FEATURE_INCOMPAT_ENCRYPT after ext4_check_large_folio() has set s_max_folio_order at mount. ext4_ioctl_set_tune_sb() requires init-namespace CAP_SYS_ADMIN, so a low-privilege attacker cannot create this prerequisite.\nPR:L - After that administrator-created state, fscrypt_ioctl_add_key() permits unprivileged v2 keys and fscrypt_ioctl_set_policy() accepts the owner of an empty directory. Ordinary create and write permission then reaches __ext4_new_inode(), large-folio allocation, and writeback without capabilities.\nUI:N - Once online tuning has left s_max_folio_order enabled, the attacker independently adds a v2 key, sets policy on their own directory, creates the inherited encrypted file, and writes it; no further victim action is required.\nS:U - The overwrite from fscrypt_encrypt_pagecache_blocks() corrupts physical pages belonging to the same host kernel in which ext4 runs; it crosses no VM, IOMMU, or other security-authority boundary.\nC:H - On non-debug builds, fscrypt_encrypt_pagecache_blocks() allocates one order-0 bounce page but encrypts enc_bytes spanning a large folio, so offsets beyond PAGE_SIZE overwrite adjacent physical pages. This kernel-memory corruption can be leveraged to expose arbitrary kernel memory.\nI:H - The same loop writes full encrypted data units beyond the bounce page, while bio_add_folio() also indexes that order-0 folio with large bh_offset values. The attacker supplies the key and plaintext and can retrieve the nonce, giving this out-of-bounds kernel write control-flow and arbitrary-write potential.\nA:H - Invalid adjacent pages are treated as bounce folios, and ext4_end_io_rsv_work() reaches ext4_end_io_end(), ext4_release_io_end(), then ext4_finish_bio(), where folio_buffers() dereferences a NULL folio at offset 0x28. This produces the demonstrated kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:34.434Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40554d1221e3d2ff2e0d192b74a05d89eb3620e7"
        }
      ],
      "title": "ext4: don\u0027t enable large folios on encrypted inodes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98941",
    "datePublished": "2026-10-23T12:12:12.296Z",
    "dateReserved": "2026-09-25T10:25:14.381Z",
    "dateUpdated": "2026-10-24T14:09:34.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted