What is the CVSS score of CVE-2026-89601?

CVE-2026-89601 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-89601?

Within 24 hours, conduct a comprehensive inventory to identify all systems running ext2 filesystems and their deployment context. Within 7 days, obtain and test the vendor-released kernel patch in a controlled non-production environment to validate filesystem integrity and application stability. Complete deployment of the patched kernel to all affected systems within 30 days, prioritizing systems storing mission-critical data on ext2 partitions.

Linux Kernel ext2 CVE-2026-89601

Q: Which versions of Linux Kernel ext2 are affected by CVE-2026-89601?

Linux systems using ext2 filesystems with synchronous inodes can silently discard file metadata changes during routine file operations without error notification.. A patch is available.

EUVD-2026-76513 HIGH

2026-09-11 Linux

GHSA-g65m-jqm9-5xv8

Linux

High

Disputed · 8.8 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Mount ext2 with sync semantics
Delivery

Write metadata to IS_SYNC inode (truncate or setxattr)
Exploit

sync_inode_metadata() skips undirtied inode
Execution

Inode update silently lost
Persist

System crash or remount exposes stale on-disk metadata
Impact

Data corruption or integrity failure

Vulnerability Assessment

Exploitation Conditions	Exploitation requires: (1) an ext2 filesystem must be present and mounted with synchronous write semantics, either via the 'sync' mount option or per-file O_SYNC/IS_SYNC semantics; (2) a process must perform a file truncation (ext2_setsize) or extended attribute write (ext2_xattr_set2) on an inode that is not already marked dirty. The vulnerability is limited to ext2 - ext3/ext4 are not affected. The impact materializes only on power loss, crash, or unmount following the silent missed sync. Non-IS_SYNC (asynchronous) ext2 mounts are not affected because those take the else-branch and correctly call mark_inode_dirty().
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H = 8.8) is materially overstated and inconsistent with the vulnerability. AV:N is incorrect - exploitation requires direct local filesystem interaction with an ext2 volume mounted with sync semantics; this is inherently a local operation. C:H is also unsupported - the bug causes lost writes (integrity), not information disclosure. The 'Information Disclosure' tag is similarly mislabeled. EPSS at 0.15% (5th percentile) and no KEV listing are consistent with a correctness/data-integrity defect rather than an exploitable attack path. Real-world impact is silent metadata corruption (truncated file sizes or xattr changes not persisted) on ext2 IS_SYNC mounts, which is a meaningful data-integrity risk for systems relying on synchronous durability guarantees, but requires local write access and a non-default mount configuration. This is a medium-severity correctness fix, not a critical security vulnerability.
Exploit ScenarioDerived	A process writing files or extended attributes to an ext2 filesystem mounted with the sync option silently loses those metadata updates if the inode was not previously dirty. After a system crash or clean unmount, the on-disk inode reflects stale metadata (wrong file size after truncation, or missing xattrs), leading to data corruption or application-level integrity failures. No public exploit code exists - this is a passive data-loss scenario triggered by normal filesystem operations, not an attacker-controlled code path.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 13, 2026

Silent inode metadata loss in the Linux kernel ext2 filesystem affects all systems using ext2 with IS_SYNC inodes: calls to sync_inode_metadata() in ext2_setsize() and ext2_xattr_set2() were guarded by an IS_SYNC branch that skipped mark_inode_dirty(), meaning that if the inode was not already dirty, the sync was a no-op and metadata changes were silently discarded. Affected operations include file truncation and extended attribute writes on synchronous ext2 mounts. No public exploit code exists and EPSS is 0.15%, consistent with a data-integrity correctness fix rather than a security-critical attack surface.

RemediationAI

Apply the upstream kernel patches at git.kernel.org/stable/c/5efb3350230fef831167740e69e6db2861101186 or git.kernel.org/stable/c/356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a, or upgrade to Linux 7.2.4 or later (7.3-rc1 also contains the fix). As a compensating control, avoid mounting ext2 filesystems with the sync mount option or using O_SYNC on ext2 volumes on unpatched kernels - this eliminates the IS_SYNC code path entirely, though it sacrifices synchronous durability guarantees. Migrating to ext4, which has a substantially more mature and actively maintained codebase, eliminates exposure to this entire class of ext2-specific bugs. No workaround preserves both sync semantics and correct behavior on unpatched kernels.

Affected VersionsENISA

Linux patch: 7.2.4

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5efb3350230fef831167740e69e6db2861101186

Linux 0 <7.2.4

Linux patch: 7.3-rc1

Affected Packages

euvd linux fix: 7.2.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The ext2 filesystem (second extended filesystem) is the classic Linux on-disk format, still found in embedded systems, boot partitions, and legacy deployments. IS_SYNC inodes are those mounted with synchronous write semantics (e.g., mount -o sync, or per-inode O_SYNC). The bug is a logic error: both ext2_setsize() (called on truncation) and ext2_xattr_set2() (called when setting extended attributes) used an if/else branch - if IS_SYNC, call sync_inode_metadata(inode, 1), else call mark_inode_dirty(). However, sync_inode_metadata() internally only writes the inode if it is flagged dirty. Since the inode was never dirtied before the sync call, the write was silently skipped. The fix marks the inode dirty unconditionally, then calls sync_inode_metadata(). No formal CWE is assigned, but this is best described as CWE-662 (Improper Synchronization) or CWE-754 (Improper Check for Unusual Conditions). CPE: cpe:2.3:a:linux:linux.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.1 MEDIUM

Local filesystem operation requiring write access to ext2 IS_SYNC inode; no confidentiality impact; integrity loss is high (silent data loss), availability impact is low.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE 3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 13, 2026 - 07:22 NVD

8.8 (HIGH)

Patch available

Sep 11, 2026 - 21:18 EUVD

CVE Published

Sep 11, 2026 - 19:45 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 11, 2026 - 19:45 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ext2: Fix lost inode updates for IS_SYNC inodes

ext2_setsize() and ext2_xattr_set2() had a construct like:

if (IS_SYNC(inode)) { sync_inode_metadata(inode, 1); } else { mark_inode_dirty(inode); }

which leads to lost inode updates for IS_SYNC inodes because sync_inode_metadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the inode dirty and *then* call sync_inode_metadata().

Executive ViewAI

Why It Matters

Linux systems using ext2 filesystems with synchronous inodes can silently discard file metadata changes during routine file operations without error notification. Organizations with ext2-based storage-particularly in embedded, legacy, or specialized infrastructure-face undetected data corruption risk that could impact business continuity and data-protection compliance requirements.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

High

Linux kernel deployed on virtually all Linux systems globally

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-89601 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 REF https://git.kernel.org/stable/c/356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a REF https://git.kernel.org/stable/c/5481766125041e71662f2e32ee0e91ad5f4d07f4 REF https://git.kernel.org/stable/c/55e66d84b5272c425b324a2b247cdacacf1e10b9 REF https://git.kernel.org/stable/c/5efb3350230fef831167740e69e6db2861101186 REF https://git.kernel.org/stable/c/b879565effd88fc119c2efea3f3868a9997ed9ba REF https://git.kernel.org/stable/c/e54de654423bee98d1ba50379b09daf97c7854a6

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back