---
id: CVE-2026-80806
title: 'ext4: don''t enable DAX on new encrypted files'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: don't enable DAX on new encrypted files

  Currently, when a new encrypted regular file is created, the call to
  ext4_set_inode_flags(inode, init=true) in __ext4_new…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    add98959b220935b243170214c787bc03044a44d
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    f53b325068bca0b238c3e0d2eb7de9b1f2268cab
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    5959cad3cfa852ec07bbdaf9c17f4838a94a8e6c
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    a13f61ba9b2a7a4ff1f140949ccfad23c5313757
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    ed1cd834da65db127f1c30ff67e78f14825a06c1
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    458776af0061afec1014cb3cd0061e282e482e83
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    3392391b363a63ebb531d45318a729b1c998565b
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    e27bae352158c007143d5bb50f3af33a177c0a37
  - >-
    Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 <
    da32af420d6d466e247c43ac0b829edeac7ae0ad
  - Linux 5.8
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:43:59.390Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80806'
references:
  - url: 'https://git.kernel.org/stable/c/add98959b220935b243170214c787bc03044a44d'
  - url: 'https://git.kernel.org/stable/c/f53b325068bca0b238c3e0d2eb7de9b1f2268cab'
  - url: 'https://git.kernel.org/stable/c/5959cad3cfa852ec07bbdaf9c17f4838a94a8e6c'
  - url: 'https://git.kernel.org/stable/c/a13f61ba9b2a7a4ff1f140949ccfad23c5313757'
  - url: 'https://git.kernel.org/stable/c/ed1cd834da65db127f1c30ff67e78f14825a06c1'
  - url: 'https://git.kernel.org/stable/c/458776af0061afec1014cb3cd0061e282e482e83'
  - url: 'https://git.kernel.org/stable/c/3392391b363a63ebb531d45318a729b1c998565b'
  - url: 'https://git.kernel.org/stable/c/e27bae352158c007143d5bb50f3af33a177c0a37'
  - url: 'https://git.kernel.org/stable/c/da32af420d6d466e247c43ac0b829edeac7ae0ad'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06305
ingestedAt: '2026-10-19T09:16:01.525Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't enable DAX on new encrypted files

Currently, when a new encrypted regular file is created, the call to
ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made
before EXT4_INODE_ENCRYPT is set.  As a result, it can set S_DAX if the
filesystem is mounted with "-o dax=always".

EXT4_INODE_ENCRYPT then actually gets set a bit later in
__ext4_new_inode(), when it calls fscrypt_set_context() which calls
ext4_set_context().  ext4_set_context() sets EXT4_INODE_ENCRYPT and
calls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too.

This was intended to clear S_DAX as well.  However, this was broken by
commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load").  This
causes data written to the file to bypass encryption, also causing
xfstests failures such as generic/548 (when "-o dax=always" is used).

Fix this by simplifying the flow by making __ext4_new_inode() set
EXT4_INODE_ENCRYPT earlier.  This makes it take effect in
ext4_set_inode_flags(inode, init=true), making S_DAX never be set.

Similarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first
place on new encrypted inodes.  Then it doesn't need to be cleared.

As a result of these simplifications, ext4_set_context() no longer needs
to change inode flags or state when 'handle != NULL'.  Remove that too.

## Affected

- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < add98959b220935b243170214c787bc03044a44d`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < f53b325068bca0b238c3e0d2eb7de9b1f2268cab`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < 5959cad3cfa852ec07bbdaf9c17f4838a94a8e6c`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < a13f61ba9b2a7a4ff1f140949ccfad23c5313757`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < ed1cd834da65db127f1c30ff67e78f14825a06c1`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < 458776af0061afec1014cb3cd0061e282e482e83`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < 3392391b363a63ebb531d45318a729b1c998565b`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < e27bae352158c007143d5bb50f3af33a177c0a37`
- `Linux >= 043546e46dc70c25ff7e2cf6d09cbb0424fc9978 < da32af420d6d466e247c43ac0b829edeac7ae0ad`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.