CVE-2026-43288
ext4 Block Bitmap Corruption Due to Uninitialized Percpu Counters
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.18.0-gba65a4e7120a-dirty |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's ext4 filesystem code. Specifically, it involves the order of initialization of per-CPU counters used during block bitmap validation. When running certain tests with the DOUBLE_CHECK macro defined, a panic is triggered because a per-CPU counter (s_freeclusters_counter) is accessed before it has been initialized. This happens because ext4_percpu_param_init() is called after ext4_mb_init(), but it needs to be called before to properly initialize these counters. The issue leads to a kernel panic during block bitmap validation.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to panic and crash when mounting or working with ext4 filesystems under certain conditions. The panic occurs due to an uninitialized per-CPU counter being accessed, which can lead to system instability or downtime. This could disrupt normal operations, cause data access interruptions, and require system reboots to recover.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the panic condition described in the CVE. Specifically, running the following commands can trigger the issue if the system is vulnerable:
- mkfs.ext4 -F -q -b 1024 /dev/sda 5G
- tune2fs -O quota,project /dev/sda
- mount /dev/sda /tmp/test
When the DOUBLE_CHECK macro is defined and these commands are run, a panic related to ext4 block bitmap checksum errors and percpu_counter initialization failure may occur, indicating the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that the ext4_percpu_param_init() function is executed before ext4_mb_init(), which initializes the per-CPU counters before they are used.
Immediate mitigation steps include updating the Linux kernel to a version where this fix has been applied, as the issue arises from improper initialization order in the ext4 filesystem code.
Until the kernel is updated, avoid running workloads or tests that trigger the ext4 block bitmap validation with the DOUBLE_CHECK macro enabled, as this can cause system panics.