Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix e4b bitmap inconsistency reports
A bitmap inconsistency issue was observed during stress tests under
mixed huge-page workloads. Ext4 reported multiple e4b bitmap check
failures like:
ext4_mb_complex_scan_group:2508: group 350, 8179 free clusters as
per group info. But got 8192 blocks
Analysis and experimentation confirmed that the issue is caused by a
race condition between page migration and bitmap modification. Although
this timing window is extremely narrow, it is still hit in practice:
folio_lock ext4_mb_load_buddy
__migrate_folio
check ref count
folio_mc_copy __filemap_get_folio
folio_try_get(folio)
......
mb_mark_used
ext4_mb_unload_buddy
__folio_migrate_mapping
folio_ref_freeze
folio_unlock
The root cause of this issue is that the fast path of load_buddy only
increments the folio's reference count, which is insufficient to prevent
concurrent folio migration. We observed that the folio migration process
acquires the folio lock. Therefore, we can determine whether to take the
fast path in load_buddy by checking the lock status. If the folio is
locked, we opt for the slow path (which acquires the lock) to close this
concurrency window.
Additionally, this change addresses the following issues:
When the DOUBLE_CHECK macro is enabled to inspect bitmap-related
issues, the following error may be triggered:
corruption in group 324 at byte 784(6272): f in copy != ff on
disk/prealloc
Analysis reveals that this is a false positive. There is a specific race
window where the bitmap and the group descriptor become momentarily
inconsistent, leading to this error report:
ext4_mb_load_buddy ext4_mb_load_buddy
__filemap_get_folio(create|lock)
folio_lock
ext4_mb_init_cache
folio_mark_uptodate
__filemap_get_folio(no lock)
......
mb_mark_used
mb_mark_used_double
mb_cmp_bitmaps
mb_set_bits(e4b->bd_bitmap)
folio_unlock
The original logic assumed that since mb_cmp_bitmaps is called when the
bitmap is newly loaded from disk, the folio lock would be sufficient to
prevent concurrent access. However, this overlooks a specific race
condition: if another process attempts to load buddy and finds the folio
is already in an uptodate state, it will immediately begin using it without
holding folio lock.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.25 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.18.14-1 | — |
| Debian 13 | linux | 6.12.85-1 | — |
| Debian 12 | linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1028.33 | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-136.136 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1061.64 | USN-8595-2 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1063.71 | USN-8606-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1062.69 | USN-8607-1 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1064.72 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1059.67 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1046.50 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1061.62 | USN-8574-3 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-136.136.2 | USN-8574-2 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1059.62 | USN-8596-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1059.62.1 | USN-8596-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1030.31 | USN-8574-3 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1058.61 | USN-8574-2 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1061.65 | USN-8665-1 |
| Ubuntu 24.04 LTS | linux-riscv +27 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1008.8 | — |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1033.34 | USN-8574-3 |
| Ubuntu 22.04 LTS | linux +49 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1061.64~22.04.1 | USN-8595-3 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1063.71~22.04.1 | USN-8606-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1062.69~22.04.1 | USN-8609-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1064.72~22.04.1 | USN-8567-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-136.136~22.04.1 | USN-8619-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1061.62~22.04.1 | USN-8574-3 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-136.136.2~22.04.1 | USN-8574-2 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1059.62~22.04.1 | USN-8596-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1058.61~22.04.1 | USN-8595-1 |
| Ubuntu 22.04 LTS | linux-riscv-6.8 | 6.8.0-136.136~22.04.3 | — |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2050.52 | USN-8665-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1056.57 | USN-8567-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1056.57~22.04.2 | USN-8567-1 |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1061.64+fips1 | USN-8595-3 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1063.71+fips2 | USN-8608-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-136.136+fips2 | USN-8574-2 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1064.72+fips1 | USN-8574-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +21 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-211.61.1.el10_2 | RHSA-2026:72624 |
| RHEL 9 | rv +75 | 5.14.0-687.53.1.el9_8 | RHSA-2026:72623 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.169.1.rt7.510.el8_10 | RHSA-2026:72467 |
| RHEL 8 | perf +26 | 4.18.0-553.169.1.el8_10 | RHSA-2026:72468 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.61.1.el10_2 | ALSA-2026:72624 |
| AlmaLinux 9 | rv +73 | 5.14.0-687.53.1.el9_8 | ALSA-2026:72623 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.169.1.rt7.510.el8_10 | ALSA-2026:72467 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.169.1.el8_10 | ALSA-2026:72468 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-211.61.1.el10_2 | RLSA-2026:72624 |
| Rocky Linux 9 | kernel | 5.14.0-687.53.1.el9_8 | RLSA-2026:72623 |
| Rocky Linux 8 | kernel | 4.18.0-553.169.1.el8_10 | RLSA-2026:72468 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.169.1.rt7.510.el8_10 | RLSA-2026:72467 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.35.1 | SUSE-SU-2026:22127-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | SUSE-SU-2026:22127-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.35.1 | SUSE-SU-2026:22127-1, SUSE-SU-2026:22099-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | SUSE-SU-2026:22127-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | SUSE-SU-2026:22112-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.35.1 | SUSE-SU-2026:22117-1, SUSE-SU-2026:22112-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | openSUSE-SU-2026:20965-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.35.1 | openSUSE-SU-2026:20965-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.12.77-99.140 +1 | 1:1.0-0.amzn2023 | ALAS2023-2026-1543, ALAS2023-2026-1514 |
| Amazon Linux 2023 | perf6.12 +14 | 1:6.12.77-99.140.amzn2023 | ALAS2023-2026-1543 |
| Amazon Linux 2023 | perf6.18 +14 | 1:6.18.15-14.217.amzn2023 | ALAS2023-2026-1514 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.139.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-211.61.1.el10_2 | ELSA-2026-72624 |
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-204.92.4.2.el10uek | ELSA-2026-50372 |
| Oracle Linux 9 | rv +28 | 5.14.0-687.53.1.el9_8 | ELSA-2026-72623 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.170.1.el8_10 | ELSA-2026-72468 |
Advisories 38
- RHSA-2026:72467 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:72468 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:72623 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:72624 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-1700 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8574-3 linux-ibm, linux-ibm-6.8, linux-nvidia-tegra, linux-xilinx vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8595-3 linux-aws-6.8, linux-aws-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8574-2 linux-fips, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8596-1 linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8665-1 linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8608-1 linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8574-1 linux-gcp-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8595-2 linux-aws vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8595-1 linux-oracle-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8567-1 linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8606-1 linux-azure, linux-azure-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8607-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8619-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8609-1 linux-azure-fde-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- ALSA-2026:72623 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:72624 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:72467 Important: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:72468 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ELSA-2026-72468 Important: kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 5, 2026
- RLSA-2026:72624 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 30, 2026
- RLSA-2026:72623 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 30, 2026
- RLSA-2026:72467 Important: kernel-rt security update Rocky Linux Security Advisories · Sep 30, 2026
- RLSA-2026:72468 Important: kernel security update Rocky Linux Security Advisories · Sep 30, 2026
- ELSA-2026-72624 Important: kernel security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 29, 2026
- ELSA-2026-72623 Important: kernel security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 29, 2026
- SUSE-SU-2026:22117-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 9, 2026
- ELSA-2026-50372 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 2, 2026
- openSUSE-SU-2026:20965-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22127-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- SUSE-SU-2026:22112-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- SUSE-SU-2026:22099-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- ALAS2023-2026-1514 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 16, 2026
- ALAS2023-2026-1543 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 16, 2026
References
- https://git.kernel.org/stable/c/a3a7d360252c0d84ae8bda067fb296c9e82928d3
- https://git.kernel.org/stable/c/57e83bfbe1e412ac42daced2086f3c6f9a17bba0
- https://git.kernel.org/stable/c/c05033cfc5c7699cd4df8d48cef94d01da755f24
- https://git.kernel.org/stable/c/29a07d691d282faf38c33d4b61839b89399110f9
- https://git.kernel.org/stable/c/f29709a7a3fc38f5015d850504762cdef0e151f9
- https://git.kernel.org/stable/c/bdc56a9c46b2a99c12313122b9352b619a2e719e