CVE-2026-74358 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix fast commit wait/wake bit mapping on 64-bit
On 64-bit, ext4 dynamic inode states live in the upper half of i_flags, and ext4_test_inode_state() applies the corresponding +32 offset.
The fast-commit wait and wake paths open-coded the wait key with the raw EXT4_STATE_* value. Add small helpers for the state wait word and bit, and use them for the FC_COMMITTING and FC_FLUSHING_DATA waits so the wait key follows the same mapping as the state helpers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides in the linux kernel's ext4 filesystem implementation where a critical inconsistency exists between how inode states are managed on 64-bit architectures versus how fast commit operations handle waiting and waking mechanisms. The core issue stems from the fundamental design of inode flag management where dynamic inode states are stored in the upper half of the i_flags field on 64-bit systems, requiring an offset adjustment of +32 when accessing these specific state values. This architectural distinction creates a mismatch in the fast commit subsystem where wait and wake operations directly reference raw EXT4_STATE_* constants without applying the necessary offset mapping that other inode state accessors use.
The technical flaw manifests in the fast commit wait and wake pathways which were implemented with hardcoded references to EXT4_STATE_* values, bypassing the established pattern used by ext4_test_inode_state() function that correctly applies the +32 offset for 64-bit systems. This inconsistency creates a scenario where the wait keys used for synchronization purposes do not align with the actual bit positions where inode states are stored, potentially leading to incorrect state checking and synchronization failures. The vulnerability specifically affects FC_COMMITTING and FC_FLUSHING_DATA wait operations that require proper mapping between the state identifiers used in waiting mechanisms and their actual storage locations within the inode flags structure.
The operational impact of this vulnerability extends beyond simple functional errors to potentially compromise filesystem consistency and data integrity during concurrent fast commit operations on 64-bit systems. When the wait and wake mechanisms operate with incorrect bit mappings, processes may experience improper blocking or premature wakeups, leading to race conditions that could result in data corruption or inconsistent filesystem states. This issue particularly affects high-performance scenarios where multiple processes simultaneously engage in fast commit operations, creating potential for deadlock conditions or premature termination of critical filesystem operations.
The fix addresses this by introducing dedicated helper functions specifically designed to compute the correct wait word and bit positions for inode states on 64-bit systems. These helpers ensure that both FC_COMMITTING and FC_FLUSHING_DATA waits utilize the same mapping logic that applies the appropriate +32 offset, maintaining consistency with ext4_test_inode_state() and other state accessors. This approach aligns with established security patterns where synchronization primitives must maintain consistent data representations across all access paths to prevent subtle race conditions that could be exploited by malicious actors or lead to system instability.
This vulnerability demonstrates a classic example of how seemingly minor inconsistencies in kernel data structure management can create significant operational risks, particularly in high-concurrency environments. The fix follows security best practices by ensuring uniform handling of state mappings and maintaining the principle of least privilege in synchronization operations. From an att&ck perspective, this could potentially be exploited to create denial of service conditions or data integrity issues through carefully crafted concurrent filesystem operations that trigger the incorrect bit mapping scenarios. The resolution aligns with cwe standards for proper state management and synchronization mechanisms within kernel subsystems, ensuring that all access paths to shared data structures maintain consistent representations.