PT-2026-34357 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31452

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ext4 filesystem where the system fails to convert files from inline data storage to extent-based storage when a truncate operation increases the file size beyond the inline capacity. This leads to an inconsistent state where the inline data flag remains set despite the file size exceeding the available inline space. Consequently, when a function like sendfile() attempts to write data, the ext4 write inline data() function triggers a kernel BUG ON() because the write size exceeds the inline capacity, which is typically limited to approximately 60 bytes for i block and 96 bytes for xattrs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31452

Affected Products

Linux Kernel

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-31452 · Security Note
• https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf · Note
• https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a · Note
• https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636 · Note
• https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6 · Note
• https://twitter.com/CVEnew/status/2046980038113841229 · Twitter Post
• https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 · Note
• https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4 · Note
• https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949 · Note
• https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669 · Note