What is the CVSS score of CVE-2026-72225?

CVE-2026-72225 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72225?

CVE-2026-72225 affects Linux ext4 filesystems and allows local users to corrupt storage metadata, rendering volumes inaccessible until manual recovery.. A patch is available.

How to fix or mitigate CVE-2026-72225?

Within 24 hours: scan infrastructure inventory to identify Linux systems with ext4 filesystems and determine which run kernel versions affected by CVE-2026-72225; flag systems with multiple local user accounts as higher priority. Within 7 days: test vendor patches in pre-production or staging Linux environments; validate filesystem stability and performance post-patch before production deployment. Within 30 days: deploy patches to production Linux systems according to maintenance windows, prioritizing storage infrastructure; post-deployment, verify filesystem integrity using kernel diagnostics to confirm journal state consistency.

Linux Kernel CVE-2026-72225

EUVD-2026-59124 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-rm6f-75fw-gq38

Authentication Bypass Linux Suse

High

Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Low–High)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with low privileges required to reach journal init; high C/I/A reflect potential for journal corruption to cascade to filesystem data integrity loss and confidentiality exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:46 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

jbd2_journal_initialize_fast_commit() validates journal capacity by checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds j_last the subtraction wraps to a large value, bypassing the bounds check.

The resulting underflow corrupts j_last, j_fc_first, and j_free, leading to journal abort.

Fix by checking num_fc_blks against j_last before the subtraction, returning -EFSCORRUPTED.

AnalysisAI

Integer underflow in the Linux kernel's jbd2 journaling subsystem corrupts critical journal metadata, aborting the filesystem journal and rendering affected ext4 volumes unavailable. Local, low-privileged attackers on unpatched systems running ext4 with the fast-commit feature can trigger the arithmetic wraparound in jbd2_journal_initialize_fast_commit() to corrupt j_last, j_fc_first, and j_free, with CVSS scoring this at 7.8 (AV:L/AC:L/PR:L). No public exploit code has been identified and CISA KEV listing is absent, with EPSS at 0.22% (14th percentile), but the breadth of the patch set across six stable kernel branches signals meaningful engineering priority across the fleet.

Technical ContextAI

JBD2 (Journal Block Device 2) is the journaling engine underpinning ext4 and other Linux filesystem implementations, providing atomic write transactions to protect against data corruption on unclean shutdown. The fast-commit feature, introduced to reduce per-transaction commit overhead, initializes journal block ranges via jbd2_journal_initialize_fast_commit(). The root cause is unsigned integer underflow (mapping to CWE-191): both j_last and num_fc_blks are unsigned types, so when num_fc_blks exceeds j_last, the subtraction j_last - num_fc_blks wraps to a large positive value rather than going negative. This silently bypasses the lower-bound guard against JBD2_MIN_JOURNAL_BLOCKS, corrupting the derived journal fields j_last, j_fc_first, and j_free and triggering journal abort. The vulnerability was introduced at commit 6866d7b3f2bb4f011041ba54c98b1584497fe2fd and fixed by returning -EFSCORRUPTED after a pre-subtraction bounds check. No CPE string was formally assigned in the NVD record.

RemediationAI

Upgrade to a patched kernel version appropriate for the deployed stable branch: 5.15.212 or later, 6.1.178 or later, 6.6.145 or later, 6.12.97 or later, 6.18.40 or later, or 7.1.5 and above for mainline. Upstream fix commits are available at kernel.org stable refs 289a2ca0c9b7, 4450dcaadf7d, 4b48dcb88bb9, 78955fdce8ff, a58fc10adf50, e144ad0250f7, and fb9b49618ed7. Systems running Linux 5.10 have no patch available (EOL branch) and should plan migration to a supported LTS branch. As a compensating control on unpatched systems, disabling the ext4 fast-commit mount option (omitting 'fast_commit' from mount parameters, or rebuilding without the CONFIG_JBD2_FAST_COMMIT option if configurable) removes the affected code path entirely; this trade-off is reduced write throughput on ext4 workloads. Additionally, restricting local user access to filesystem mount operations via Linux user namespaces policies limits the set of principals who can reach the vulnerable initialization path.

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72225 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72225

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code