Skip to main content

Linux Kernel EUVDEUVD-2026-59124

| CVE-2026-72225 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-rm6f-75fw-gq38
Authentication Bypass Linux Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local access with low privileges required to reach journal init; high C/I/A reflect potential for journal corruption to cascade to filesystem data integrity loss and confidentiality exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:46 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

jbd2_journal_initialize_fast_commit() validates journal capacity by checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds j_last the subtraction wraps to a large value, bypassing the bounds check.

The resulting underflow corrupts j_last, j_fc_first, and j_free, leading to journal abort.

Fix by checking num_fc_blks against j_last before the subtraction, returning -EFSCORRUPTED.

AnalysisAI

Integer underflow in the Linux kernel's jbd2 journaling subsystem corrupts critical journal metadata, aborting the filesystem journal and rendering affected ext4 volumes unavailable. Local, low-privileged attackers on unpatched systems running ext4 with the fast-commit feature can trigger the arithmetic wraparound in jbd2_journal_initialize_fast_commit() to corrupt j_last, j_fc_first, and j_free, with CVSS scoring this at 7.8 (AV:L/AC:L/PR:L). No public exploit code has been identified and CISA KEV listing is absent, with EPSS at 0.22% (14th percentile), but the breadth of the patch set across six stable kernel branches signals meaningful engineering priority across the fleet.

Technical ContextAI

JBD2 (Journal Block Device 2) is the journaling engine underpinning ext4 and other Linux filesystem implementations, providing atomic write transactions to protect against data corruption on unclean shutdown. The fast-commit feature, introduced to reduce per-transaction commit overhead, initializes journal block ranges via jbd2_journal_initialize_fast_commit(). The root cause is unsigned integer underflow (mapping to CWE-191): both j_last and num_fc_blks are unsigned types, so when num_fc_blks exceeds j_last, the subtraction j_last - num_fc_blks wraps to a large positive value rather than going negative. This silently bypasses the lower-bound guard against JBD2_MIN_JOURNAL_BLOCKS, corrupting the derived journal fields j_last, j_fc_first, and j_free and triggering journal abort. The vulnerability was introduced at commit 6866d7b3f2bb4f011041ba54c98b1584497fe2fd and fixed by returning -EFSCORRUPTED after a pre-subtraction bounds check. No CPE string was formally assigned in the NVD record.

RemediationAI

Upgrade to a patched kernel version appropriate for the deployed stable branch: 5.15.212 or later, 6.1.178 or later, 6.6.145 or later, 6.12.97 or later, 6.18.40 or later, or 7.1.5 and above for mainline. Upstream fix commits are available at kernel.org stable refs 289a2ca0c9b7, 4450dcaadf7d, 4b48dcb88bb9, 78955fdce8ff, a58fc10adf50, e144ad0250f7, and fb9b49618ed7. Systems running Linux 5.10 have no patch available (EOL branch) and should plan migration to a supported LTS branch. As a compensating control on unpatched systems, disabling the ext4 fast-commit mount option (omitting 'fast_commit' from mount parameters, or rebuilding without the CONFIG_JBD2_FAST_COMMIT option if configurable) removes the affected code path entirely; this trade-off is reduced write throughput on ext4 workloads. Additionally, restricting local user access to filesystem mount operations via Linux user namespaces policies limits the set of principals who can reach the vulnerable initialization path.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59124 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy