[SRU][J][PATCH 0/1] CVE-2026-31448

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-31448

[ Impact ]

On the mkdir/mknod path, when ext4 maps logical blocks to physical blocks, a
failure to insert a new extent into the extent tree causes
ext4_ext_map_blocks() to free the physical block without removing the
corresponding entry from the extent tree. Subsequent mkdir operations then
reference the previously reclaimed physical block, even though it is already in
use by an xattr block, leaving the directory and xattr sharing the same buffer
head block in memory. This drives ext4_xattr_block_set() into an infinite loop
that never releases the inode lock, resulting in tasks blocked for over 143
seconds. With a CVSS score of 9.4, this is a high-severity denial-of-service
issue triggerable on corrupted or crafted filesystems.

[ Fix ]

jammy: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change would affect the ext4 extent mapping and block
allocation paths, potentially causing incorrect block freeing, quota accounting
errors, or filesystem inconsistency during directory and inode creation
operations.