CVE-2026-93268

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: skip extra isize expansion during mount to prevent deadlock

ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()

while holding an active jbd2 handle. During mount (!SB_ACTIVE), the

expand path may move xattrs to external blocks and release ea_inodes via

iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires

s_writepages_rwsem, creating a circular lock dependency:

s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem

This can be triggered via:

ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()

-> ext4_try_to_expand_extra_isize()

or:

ext4_evict_inode() -> ext4_mark_inode_dirty()

-> ext4_try_to_expand_extra_isize()

Skip expansion when !SB_ACTIVE. This is a minor loss of functionality

(extra isize won't grow for these inodes during mount), which e2fsck

can resolve later if needed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References