GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89601 (GCVE-0-2026-89601)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:31
VLAI
Title
ext2: Fix lost inode updates for IS_SYNC inodes
Summary
In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had a construct like: if (IS_SYNC(inode)) { sync_inode_metadata(inode, 1); } else { mark_inode_dirty(inode); } which leads to lost inode updates for IS_SYNC inodes because sync_inode_metadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the inode dirty and *then* call sync_inode_metadata().
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5efb3350230fef831167740e69e6db2861101186 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext2/inode.c",
            "fs/ext2/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5efb3350230fef831167740e69e6db2861101186",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext2/inode.c",
            "fs/ext2/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: Fix lost inode updates for IS_SYNC inodes\n\next2_setsize() and ext2_xattr_set2() had a construct like:\n\n\tif (IS_SYNC(inode)) {\n\t\tsync_inode_metadata(inode, 1);\n\t} else {\n\t\tmark_inode_dirty(inode);\n\t}\n\nwhich leads to lost inode updates for IS_SYNC inodes because\nsync_inode_metadata() does anything only if the inode is already dirty\nand hence inode updates may be simply lost. Fix the problem by\nunconditionally marking the inode dirty and *then* call\nsync_inode_metadata()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd SETATTR/SETXATTR and ksmbd truncate/EA handling call notify_change()/vfs_setxattr() into ext2_setattr()/ext2_xattr_set2() when an ext2 volume is NFS/SMB-exported (NAS and embedded USB-storage appliances, including sync-mounted disks); a remote client with write access therefore reaches the lost IS_SYNC inode update without a local shell.\nAC:L - The attacker can put the target in the IS_SYNC state at will (owner-writable FS_IOC_SETFLAGS/chattr +S, or a sync-mounted export) and then deterministically truncate or set/remove xattrs; sync_inode_metadata() skips a clean inode every time, with no race or memory layout outside attacker control.\nPR:L - The path is gated only by ordinary VFS write checks (inode_permission MAY_WRITE, xattr_permission for user.* xattrs, or inode_owner_or_capable() for FS_IOC_SETFLAGS); an unprivileged local user or a low-privilege NFS/SMB client with write access to a file suffices, and no init-namespace capability is required.\nUI:N - The attacker performs every step themselves (setting the SYNC flag, truncating or changing xattrs/ACLs, and driving inode reclaim); no separate victim action such as mounting a crafted image is required.\nS:U - Impact is confined to filesystem metadata and file data on the host that mounted the ext2 volume; this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:H - Removing the last xattr on an IS_SYNC inode frees the EA block without persisting i_file_acl=0, leaving a dangling on-disk pointer; after that block is reused, ext2_xattr_get() memcpy()s its contents to userspace when the header looks valid, so the filesystem-level UAF discloses other files\u0027 data.\nI:H - The lost i_file_acl update leaves the on-disk inode pointing at a freed EA block, so a later in-place xattr write can corrupt whatever reused that block, including other users\u0027 files and metadata; intended-durable IS_SYNC size/ctime/ACL updates can also fail to land, corrupting filesystem state.\nA:H - Reloading the stale i_file_acl and reading an invalid reused EA block calls ext2_error(), which panics on errors=panic and remounts the volume read-only on errors=remount-ro; the resulting filesystem inconsistency can also render files and the volume unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:34.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5efb3350230fef831167740e69e6db2861101186"
        },
        {
          "url": "https://git.kernel.org/stable/c/356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a"
        }
      ],
      "title": "ext2: Fix lost inode updates for IS_SYNC inodes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89601",
    "datePublished": "2026-09-11T19:45:04.667Z",
    "dateReserved": "2026-09-11T19:38:34.732Z",
    "dateUpdated": "2026-09-13T06:31:34.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89601",
      "date": "2026-09-16",
      "epss": "0.00348",
      "percentile": "0.2825"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89601\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:44.993\",\"lastModified\":\"2026-09-13T07:17:25.520\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next2: Fix lost inode updates for IS_SYNC inodes\\n\\next2_setsize() and ext2_xattr_set2() had a construct like:\\n\\n\\tif (IS_SYNC(inode)) {\\n\\t\\tsync_inode_metadata(inode, 1);\\n\\t} else {\\n\\t\\tmark_inode_dirty(inode);\\n\\t}\\n\\nwhich leads to lost inode updates for IS_SYNC inodes because\\nsync_inode_metadata() does anything only if the inode is already dirty\\nand hence inode updates may be simply lost. Fix the problem by\\nunconditionally marking the inode dirty and *then* call\\nsync_inode_metadata().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext2/inode.c\",\"fs/ext2/xattr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"5efb3350230fef831167740e69e6db2861101186\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext2/inode.c\",\"fs/ext2/xattr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5efb3350230fef831167740e69e6db2861101186\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-16T05:51:17+00:00",
      "cve": "CVE-2026-89601",
      "id": "CVE-2026-89601",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "262",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext2: Fix lost inode updates for IS_SYNC inodes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89601.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.