PT-2026-34353 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-05-15 · CVE-2026-31448

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ext4 file system during the mkdir and mknod paths. When mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails, the ext4 ext map blocks() function calls ext4 free blocks() to reclaim the physical block but fails to delete the corresponding data in the extent tree. This results in subsequent mkdir operations referencing a reclaimed physical block already in use by the xattr block, causing both the directory and xattr to use the same buffer head block in memory simultaneously. Consequently, the ext4 xattr block set() function enters an infinite loop and cannot release the inode lock, leading to system blocking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-31448

ECHO-3C7E-EFC5-9E72

OESA-2026-2311

Affected Products

Linux Kernel

References · 51

• https://cve.org/CVERecord?id=CVE-2026-31448 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31699 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43079 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31592 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31523 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31441 · Security Note
• https://ubuntu.com/security/CVE-2026-31448 · Vendor Advisory
• https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31448 · Vendor Advisory
• https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31476 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31674 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31667 · Security Note
• https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412 · Patch