---
id: CVE-2026-72225
title: 'jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

  jbd2_journal_initialize_fast_commit() validates journal capacity by
  checking (journal->j_last - nu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    aa90f00932bf572d6ef284c977c2a60b39c13bd6
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    e144ad0250f77e23e28949587b8b57e40dc3b512
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    fb9b49618ed7296ebfad62a3835da8945f727001
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    78955fdce8ff654e6d33a2fa90882a1e7eb26330
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    a58fc10adf503969fec2007b5afe8987258046c4
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    289a2ca0c9b7eae74f93fc213b0b971669b8683d
  - Linux 5.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:44:09.066812Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:02.597Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72225'
references:
  - url: 'https://git.kernel.org/stable/c/aa90f00932bf572d6ef284c977c2a60b39c13bd6'
  - url: 'https://git.kernel.org/stable/c/e144ad0250f77e23e28949587b8b57e40dc3b512'
  - url: 'https://git.kernel.org/stable/c/4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6'
  - url: 'https://git.kernel.org/stable/c/fb9b49618ed7296ebfad62a3835da8945f727001'
  - url: 'https://git.kernel.org/stable/c/4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9'
  - url: 'https://git.kernel.org/stable/c/78955fdce8ff654e6d33a2fa90882a1e7eb26330'
  - url: 'https://git.kernel.org/stable/c/a58fc10adf503969fec2007b5afe8987258046c4'
  - url: 'https://git.kernel.org/stable/c/289a2ca0c9b7eae74f93fc213b0b971669b8683d'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.06789
ingestedAt: '2026-10-16T19:46:24.421Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

jbd2_journal_initialize_fast_commit() validates journal capacity by
checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS).
Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds
j_last the subtraction wraps to a large value, bypassing the bounds
check.

The resulting underflow corrupts j_last, j_fc_first, and j_free,
leading to journal abort.

Fix by checking num_fc_blks against j_last before the subtraction,
returning -EFSCORRUPTED.

## Affected

- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < aa90f00932bf572d6ef284c977c2a60b39c13bd6`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < e144ad0250f77e23e28949587b8b57e40dc3b512`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < fb9b49618ed7296ebfad62a3835da8945f727001`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 78955fdce8ff654e6d33a2fa90882a1e7eb26330`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < a58fc10adf503969fec2007b5afe8987258046c4`
- `Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 289a2ca0c9b7eae74f93fc213b0b971669b8683d`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.