{"id":"CVE-2026-72225","revision":"b6fbb34fd0bb411594f54a7a57457be8","records":[{"revision":"b6fbb34fd0bb411594f54a7a57457be8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72225","aliases":[],"title":"jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()\n\njbd2_journal_initialize_fast_commit() validates journal capacity by\nchecking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS).\nBoth j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds\nj_last the subtraction wraps to a large value, bypassing the bounds\ncheck.\n\nThe resulting underflow corrupts j_last, j_fc_first, and j_free,\nleading to journal abort.\n\nFix by checking num_fc_blks against j_last before the subtraction,\nreturning -EFSCORRUPTED.","state":0,"publishedAt":"2026-08-15T05:54:17.541+00:00","modifiedAt":"2026-10-16T18:45:02.597+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/jbd2/journal.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"aa90f00932bf572d6ef284c977c2a60b39c13bd6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"e144ad0250f77e23e28949587b8b57e40dc3b512\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"fb9b49618ed7296ebfad62a3835da8945f727001\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"78955fdce8ff654e6d33a2fa90882a1e7eb26330\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"a58fc10adf503969fec2007b5afe8987258046c4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6866d7b3f2bb4f011041ba54c98b1584497fe2fd\",\n                            \"lessThan\": \"289a2ca0c9b7eae74f93fc213b0b971669b8683d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/jbd2/journal.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.266\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/aa90f00932bf572d6ef284c977c2a60b39c13bd6","https://git.kernel.org/stable/c/e144ad0250f77e23e28949587b8b57e40dc3b512","https://git.kernel.org/stable/c/4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6","https://git.kernel.org/stable/c/fb9b49618ed7296ebfad62a3835da8945f727001","https://git.kernel.org/stable/c/4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9","https://git.kernel.org/stable/c/78955fdce8ff654e6d33a2fa90882a1e7eb26330","https://git.kernel.org/stable/c/a58fc10adf503969fec2007b5afe8987258046c4","https://git.kernel.org/stable/c/289a2ca0c9b7eae74f93fc213b0b971669b8683d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72225","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72225","identifiers":["CVE-2026-72225"]},"retained":false,"historicalAffected":[]}],"coverage":[]}