ACK: [SRU][J][PATCH 0/1] CVE-2026-31448

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 16:58, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31448
>
> [ Impact ]
>
> On the mkdir/mknod path, when ext4 maps logical blocks to physical blocks, a
> failure to insert a new extent into the extent tree causes
> ext4_ext_map_blocks() to free the physical block without removing the
> corresponding entry from the extent tree. Subsequent mkdir operations then
> reference the previously reclaimed physical block, even though it is already in
> use by an xattr block, leaving the directory and xattr sharing the same buffer
> head block in memory. This drives ext4_xattr_block_set() into an infinite loop
> that never releases the inode lock, resulting in tasks blocked for over 143
> seconds. With a CVSS score of 9.4, this is a high-severity denial-of-service
> issue triggerable on corrupted or crafted filesystems.
>
> [ Fix ]
>
> jammy: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change would affect the ext4 extent mapping and block
> allocation paths, potentially causing incorrect block freeing, quota accounting
> errors, or filesystem inconsistency during directory and inode creation
> operations.
>