CVE-2026-31447

Vulnerability

CVE-2026-31447 is a vulnerability in the Linux kernel's ext4 filesystem driver. The ext4 driver previously allowed mounting a filesystem that uses the bigalloc feature while also having a non-zero s_first_data_block value. This combination is not supported by the ext4 implementation and could lead to undefined behavior or corruption.

Exploitation

An attacker with the ability to mount a crafted ext4 filesystem image (e.g., via a removable device or a malicious filesystem image) could trigger this unsupported configuration. No special privileges beyond mount access are required, but the attacker must be able to present a filesystem with the bigalloc feature flag set and a non-zero s_first_data_block.

Impact

Mounting such a filesystems with this unsupported combination could result in filesystem corruption, data loss, or potentially a system crash. The exact impact depends on the kernel's handling of the invalid state, but the vulnerability is rated High (CVSS 7.8) due to the potential for local privilege escalation or denial of service.

Mitigation

The fix, merged into the Linux kernel stable branches, adds a check during mount to reject any ext4 filesystem that has both the bigalloc feature and a non-zero s_first_data_block. Users should update their kernel to include the patch commit [1] or any of the subsequent stable backports [2][3][4]. No workaround exists other than avoiding the use of such crafted filesystems.