What’s Vulnerable › Vulnerabilities

CVE-2026-31451: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-15
• Weakness: CWE-617

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption. The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption.

Affected products

• Linux kernel: from 3.8 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5 — fixed in 6.12.80, 6.18.21, 6.19.11, 6.6.131

How to fix

Upgrade to a fixed version: Linux kernel 6.12.80, 6.18.21, 6.19.11, 6.6.131. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee
• https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf
• https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b
• https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd
• https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda
• https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2
• https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e
• https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2026-31451 or the next vulnerability affects your stack