Skip to main content

Linux Kernel EUVDEUVD-2026-24790

| CVE-2026-31451 MEDIUM
Reachable Assertion (CWE-617)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4jw8-cp5g-24j2
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only access with low privilege sufficient to trigger the assertion; kernel panic yields high availability impact; no confidentiality or integrity effect described or applicable.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 05:21 vuln.today
CVSS changed
May 06, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch released
Apr 23, 2026 - 16:17 nvd
Patch available
Patch available
Apr 22, 2026 - 16:02 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24790
CVE Published
Apr 22, 2026 - 14:16 nvd
N/A
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio

Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption.

The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption.

AnalysisAI

Kernel panic via reachable assertion in the Linux kernel ext4 filesystem driver allows a local low-privileged user to crash the system by presenting an ext4 filesystem with inline data exceeding PAGE_SIZE, triggering BUG_ON() in ext4_read_inline_folio(). Affected branches span 6.6.x through 7.0-rc5; patched releases are available as 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. No public exploit code exists and EPSS stands at 0.02% (5th percentile), consistent with the absence of active exploitation from CISA KEV.

Technical ContextAI

The vulnerability resides in ext4_read_inline_folio() within the Linux kernel's ext4 filesystem driver. CWE-617 (Reachable Assertion) is the root cause: a BUG_ON() macro asserted that inline inode data cannot exceed PAGE_SIZE, but a corrupted or adversarially crafted ext4 filesystem image can violate this invariant. When BUG_ON() fires in kernel context, it unconditionally triggers a kernel oops or panic, immediately crashing the system. The fix replaces the assertion with structured error handling: ext4_error_inode() logs the corruption event, the buffer head is released to avoid a memory leak, and -EFSCORRUPTED is returned to propagate the error gracefully up the call stack. CPE data confirms the affected product is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across all stable branches from the initial history commit through 7.0-rc5. The inline_data ext4 feature flag is a prerequisite for the vulnerable code path to be reachable.

RemediationAI

The primary fix is a kernel upgrade to a patched stable release: 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0 depending on the branch deployed. Upstream fix commits are available at the kernel stable tree (https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2 for 6.6.x, https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf for 6.18.x, https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda for 6.19.x, and https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd for 7.0). Ubuntu users should apply USN-8567-1. Where an immediate kernel upgrade is operationally blocked, reduce exposure by preventing unprivileged users from mounting ext4 filesystems (revoke CAP_SYS_ADMIN, enforce mount namespace restrictions, or use a policy such as 'user_allow_other=no' in FUSE combined with AppArmor/SELinux deny-mount rules); note these controls restrict legitimate user workflows and must be tested before deployment. Avoid allowing untrusted ext4 disk images in environments where local users could trigger filesystem reads on them.

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-24790 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy