CVE-2026-72225

Received Received - Intake

Integer Underflow in Linux Kernel JBD2

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() jbd2_journal_initialize_fast_commit() validates journal capacity by checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds j_last the subtraction wraps to a large value, bypassing the bounds check. The resulting underflow corrupts j_last, j_fc_first, and j_free, leading to journal abort. Fix by checking num_fc_blks against j_last before the subtraction, returning -EFSCORRUPTED.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72225

EUVD

EUVD-2026-59124

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	jbd2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's jbd2 (Journaling Block Device 2) subsystem. It involves an integer underflow in the function jbd2_journal_initialize_fast_commit(). The issue occurs when num_fc_blks exceeds j_last, causing an unsigned integer subtraction to wrap around to a large value. This bypasses a bounds check and corrupts critical journal metadata (j_last, j_fc_first, j_free), leading to a journal abort.

Detection Guidance

This vulnerability affects the Linux kernel's jbd2 journaling subsystem. Detection requires checking kernel logs for journal abort errors or corruption messages. Monitor for errors like 'jbd2_journal_initialize_fast_commit: journal corruption detected' or 'abort()' calls in system logs. Use commands like 'dmesg | grep jbd2' or 'journalctl -k | grep -i jbd2' to inspect kernel logs for signs of journal corruption or aborts.

Impact Analysis

If exploited, this vulnerability could cause filesystem corruption or system crashes by triggering a journal abort. Users might experience data loss, system instability, or denial of service if the kernel's journaling system fails during disk operations.

Compliance Impact

This vulnerability affects data integrity and availability in the Linux kernel's journaling system. While not directly linked to GDPR or HIPAA, it could lead to data corruption or loss, which may violate compliance requirements for data protection and integrity in these standards.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the jbd2 integer underflow vulnerability. If immediate patching is not possible, consider disabling fast commit features if supported by your kernel version. Monitor system stability and check for journal corruption errors after applying mitigations.

Hi! I’m here to help you understand CVE-2026-72225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70