CVE-2026-31450

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: publish jinode after initialization

ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.

It used to set ei->jinode before jbd2_journal_init_jbd_inode(),

allowing a reader to observe a non-NULL jinode with i_vfs_inode

still unset.

The fast commit flush path can then pass this jinode to

jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and

may crash.

Below is the crash I observe:

```

BUG: unable to handle page fault for address: 000000010beb47f4

PGD 110e51067 P4D 110e51067 PUD 0

Oops: Oops: 0000 [#1] SMP NOPTI

CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014

RIP: 0010:xas_find_marked+0x3d/0x2e0

Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References