CVE-2026-43068

ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()

published May 5, 2026

CVSS
—
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()

There's issue as follows:

...

EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117

EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost

EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117

EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost

EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117

EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost

EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117

EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost

EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117

EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost

EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117

EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost

EXT4-fs (mmcblk0p1): error count since last fsck: 1

EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760

EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760

...

According to the log analysis, blocks are always requested from the

corrupted block group. This may happen as follows:

ext4_mb_find_by_goal

ext4_mb_load_buddy

ext4_mb_load_buddy_gfp

ext4_mb_init_cache

ext4_read_block_bitmap_nowait

ext4_wait_block_bitmap

ext4_validate_block_bitmap

if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))

return -EFSCORRUPTED; // There's no logs.

if (err)

return err; // Will return error

ext4_lock_group(ac->ac_sb, group);

if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable

goto out;

After commit 9008a58e5dce ("ext4: make the bitmap read routines return

real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group

as corrupt on block bitmap error") is no real solution for allocating

blocks from corrupted block groups. This is because if

'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then

'ext4_mb_load_buddy()' may return an error. This means that the block

allocation will fail.

Therefore, check block group if corrupted when ext4_mb_load_buddy()

returns error.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Published
2026-05-05T15:23Z
EPSS history
Timeline
  • 05 MAY 15:23Z
    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
    cvelistv5