{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-98941",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-25T10:25:14.381Z",
        "datePublished": "2026-10-23T12:12:12.296Z",
        "dateUpdated": "2026-10-24T14:09:34.434Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-10-24T14:09:34.434Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't enable large folios on encrypted inodes\n\nCommit 709f0f1f1bf5 (\"ext4: add checks for large folio\nincompatibilities when BS > PS\") disables large folios at mount time\nif the \"encrypt\" feature is set. However, enabling that feature on a\nmounted filesystem circumvents that check, and writing encrypted data\nresults in a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work\n  RIP: 0010:ext4_finish_bio+0xf7/0x3e0\n  Call Trace:\n   ext4_release_io_end+0x51/0x110\n   ext4_end_io_end+0x4c/0xe0\n   ext4_end_io_rsv_work+0xb3/0x100\n\nFix this by disabling large folios on encrypted inodes, as is\nalready done for inodes that use data journaling.\n\nThis affects all kernels between v6.19 and v7.2, but it is not needed\nin v7.3, where the code was significantly refactored."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - An unprivileged owner can create an encrypted file and use write(2) through ext4_file_write_iter() and generic_perform_write(); __ext4_new_inode() reaches the patched ext4_set_inode_mapping_order(), which wrongly permits a large folio. No remote protocol supplies the triggering data.\nAC:H - The vulnerable state requires EXT4_IOC_SET_TUNE_SB_PARAM to enable EXT4_FEATURE_INCOMPAT_ENCRYPT after ext4_check_large_folio() has set s_max_folio_order at mount. ext4_ioctl_set_tune_sb() requires init-namespace CAP_SYS_ADMIN, so a low-privilege attacker cannot create this prerequisite.\nPR:L - After that administrator-created state, fscrypt_ioctl_add_key() permits unprivileged v2 keys and fscrypt_ioctl_set_policy() accepts the owner of an empty directory. Ordinary create and write permission then reaches __ext4_new_inode(), large-folio allocation, and writeback without capabilities.\nUI:N - Once online tuning has left s_max_folio_order enabled, the attacker independently adds a v2 key, sets policy on their own directory, creates the inherited encrypted file, and writes it; no further victim action is required.\nS:U - The overwrite from fscrypt_encrypt_pagecache_blocks() corrupts physical pages belonging to the same host kernel in which ext4 runs; it crosses no VM, IOMMU, or other security-authority boundary.\nC:H - On non-debug builds, fscrypt_encrypt_pagecache_blocks() allocates one order-0 bounce page but encrypts enc_bytes spanning a large folio, so offsets beyond PAGE_SIZE overwrite adjacent physical pages. This kernel-memory corruption can be leveraged to expose arbitrary kernel memory.\nI:H - The same loop writes full encrypted data units beyond the bounce page, while bio_add_folio() also indexes that order-0 folio with large bh_offset values. The attacker supplies the key and plaintext and can retrieve the nonce, giving this out-of-bounds kernel write control-flow and arbitrary-write potential.\nA:H - Invalid adjacent pages are treated as bounce folios, and ext4_end_io_rsv_work() reaches ext4_end_io_end(), ext4_release_io_end(), then ext4_finish_bio(), where folio_buffers() dereferences a NULL folio at offset 0x28. This produces the demonstrated kernel oops or panic."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/ext4/inode.c"
                    ],
                    "versions": [
                        {
                            "version": "709f0f1f1bf5ca62a000084e5446ca6b57c8678c",
                            "lessThan": "40554d1221e3d2ff2e0d192b74a05d89eb3620e7",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/ext4/inode.c"
                    ],
                    "versions": [
                        {
                            "version": "6.19",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.19",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.10",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.19",
                                    "versionEndExcluding": "7.2.10"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/40554d1221e3d2ff2e0d192b74a05d89eb3620e7"
                }
            ],
            "title": "ext4: don't enable large folios on encrypted inodes",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}