---
id: CVE-2026-93268
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: skip extra isize expansion during mount to prevent deadlock

  ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()
  while holding an active jbd…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: skip extra isize expansion during mount to prevent deadlock

  ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()
  while holding an active jbd…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    41897f1bcf4ace5f1f28d0be784b6f4f0e929641
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    9c3469377b1d8caba6bec6ef3c460810bbfb02cc
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    1dd4882dbdc8bfdf2182fa388883c143fac0902a
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    7ba09330d9ea6e996228316719eae812d7e04983
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    c5e6434cc55f30220b228be237bb666351f9f4dd
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    7ace189b9ea79cf78df9c32b940ce12735f9459a
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    2fb8ff81659a57c42bb7b49e8339a2be2a318ef8
  - >-
    Linux >= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f <
    7461c60b9c6a839b13ad4c3490681a0cf5aa0637
  - Linux 4.7
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:23.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93268'
references:
  - url: 'https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.838Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ext4: skip extra isize expansion during mount to prevent deadlock

ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()
while holding an active jbd2 handle.  During mount (!SB_ACTIVE), the
expand path may move xattrs to external blocks and release ea_inodes via
iput().  When !SB_ACTIVE, iput() calls write_inode_now() which acquires
s_writepages_rwsem, creating a circular lock dependency:

  s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem

This can be triggered via:

  ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()
    -> ext4_try_to_expand_extra_isize()

or:

  ext4_evict_inode() -> ext4_mark_inode_dirty()
    -> ext4_try_to_expand_extra_isize()

Skip expansion when !SB_ACTIVE.  This is a minor loss of functionality
(extra isize won't grow for these inodes during mount), which e2fsck
can resolve later if needed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.