Unrated severityNVD Advisory· Published May 27, 2026· Updated May 27, 2026

CVE-2026-45920

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix dirtyclusters double decrement on fs shutdown

fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count:

WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]

Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks().

First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency.

To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A double decrement of the dirty clusters counter in ext4's error path during filesystem shutdown can trigger a kernel warning.

Vulnerability

In the Linux kernel, a double decrement of the s_dirtyclusters_counter exists in the ext4 filesystem, introduced in the error path between ext4_mb_mark_diskspace_used() and ext4_mb_new_blocks(). When a filesystem shutdown triggers an error from ext4_handle_dirty_metadata() called via ext4_mb_mark_context(), ext4_mb_mark_diskspace_used() decrements both cluster counters and returns the error to ext4_mb_new_blocks(), which then decrements the dirty clusters counter again, leading to an inconsistency. This was identified via the fstests test generic/388, which reproduces a warning in ext4_put_super(). The issue affects Linux kernel versions prior to the fix commit 61e372122b6d ("ext4: fix dirtyclusters double decrement on fs shutdown"). [1]

Exploitation

An attacker must be able to trigger a filesystem shutdown (e.g., via fsstress or other stress tools) while ext4_mb_mark_diskspace_used() is executing, such that an error occurs in the ext4_handle_dirty_metadata() calls. The race window is triggered by random shutdown injections during filesystem operations. No special privileges are required beyond the ability to cause a filesystem shutdown on a mounted ext4 filesystem. [1]

Impact

A double decrement of the dirty clusters count results in a kernel warning and a negative counter value (s_dirtyclusters_counter - 1). While not directly exploitable for arbitrary code execution, it causes a denial of service (DoS) through kernel warning messages and potential filesystem instability. The impact is limited to availability (integrity and confidentiality are not directly affected). [1]

Mitigation

The fix is included in Linux kernel commit 61e372122b6d9aec940fdaea0a16f988f359897, which lifts the counter reduction to a single place in the caller ext4_mb_new_blocks() to avoid the double decrement. This commit was incorporated into stable kernel updates. Users should apply the latest kernel updates from their distribution. No workaround exists other than avoiding filesystem shutdown during concurrent ext4 operations; upgrading to a patched kernel is the recommended mitigation. [1]

References

Making sure you're not a bot!

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

Linux/Kernelllm-fuzzy

Patches

523d5a4df3c6

ext4: fix dirtyclusters double decrement on fs shutdown

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitBrian FosterFeb 25, 2026Fixed in 5.10.253via kernel-cna

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Vulnerability

Exploitation

Impact

Mitigation

Root cause

Attack vector

Affected code

What the fix does

Preconditions