CVE-2026-98941 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel and ext4 filesystem configurations should assess exposure and prioritize patching for versions between v6.19 and v7.2. Operators of Linux-based systems, platform administrators, and security teams should review and update ext4 filesystem configurations to ensure large folios are not enabled on encrypted inodes. Vulnerability management teams should verify Linux kernel versions and apply patches for versions between v6

Why it matters

Defenders should prioritize patching Linux kernel versions between v6.19 and v7.2 due to a vulnerability in the ext4 filesystem implementation that can lead to system crashes when writing encrypted data with large folios enabled.

• Potential system crashes when writing encrypted data on ext4 filesystems with large folios enabled
• Need to verify and apply patches for Linux kernel versions between v6.19 and v7.2
• Potential impact on system stability and data integrity

Technical summary

The Linux kernel's ext4 filesystem implementation has a vulnerability that can lead to a crash when writing encrypted data if large folios are enabled on encrypted inodes. This issue was resolved by disabling large folios on encrypted inodes, similar to how it is handled for inodes using data journaling. The vulnerability arises when the 'encrypt' feature is enabled on a mounted filesystem, bypassing checks that disable large folios at mount time. The issue affects Linux kernel versions between v6.19 and v7.2, but is not present in v7.3 due to significant code refactoring.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions between v6.19 and v7.2, especially for systems using encrypted inodes with ext4 filesystem.

Recommended defensive actions

• Verify Linux kernel version and apply patches for versions between v6.19 and v7.2
• Review and update ext4 filesystem configurations to ensure large folios are not enabled on encrypted inodes
• Monitor system logs for potential crashes or errors related to ext4 filesystem and encrypted inodes
• Perform vulnerability assessment to identify potential exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was resolved by disabling large folios on encrypted inodes. The issue arises when the 'encrypt' feature is enabled on a mounted filesystem, bypassing checks that disable large folios at mount time.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.