CVE-2026-74308

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix kernel BUG in ext4_write_inline_data_end

When the data=journal mount option is used, the ext4_journalled_write_end()

function incorrectly calls ext4_write_inline_data_end() without checking

if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode.

If a previous attempt to convert the inline data to an extent failed (e.g.

due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but

the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next

call to ext4_write_begin() will not prepare the inline data xattr for

writing, but ext4_journalled_write_end() will incorrectly attempt to write

to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in

ext4_write_inline_data() since i_inline_size was not expanded.

Fix this by ensuring that ext4_journalled_write_end() only calls

ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is

set, mirroring the behavior of

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References