ext4: publish jinode after initialization

{
  "id": "7dd93a797ff0ac04f1aab80f486f88bb2d1116102b6c4d2f1a45295dbe730b7f",
  "url": "https://osv.dev/vulnerability/CVE-2026-31450",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ext4: publish jinode after initialization",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset. The fast commit flush path can then pass this jinode to jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and may crash. Below is the crash I observe: ``` BUG: unable to handle page fault for address: 000000010beb47f4 PGD 110e51067 P4D 110e51067 PUD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 RIP: 0010:xas_find_marked+0x3d/0x2e0 Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02 RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246 RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003 RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10 RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000 R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88 FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000",
    "evidence": "osv:CVE-2026-31450",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.253",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.203",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.168",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.134",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.81",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.21",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.11",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-31450",
      "aliases": [
        "CVE-2026-31450"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "a361293f5fedea0016a10599f409631a15d47ee7"
                },
                {
                  "fixed": "2d2b648960147d078b000b9a7494017082024366"
                },
                {
                  "fixed": "e4325e84727e539c8597bd5b8491349f57f7fb17"
                },
                {
                  "fixed": "be54c0055407a73b60349c093c8ce621cb8fa232"
                },
                {
                  "fixed": "a070d5a872ffe0e0fe5c46eda6386140ded39adb"
                },
                {
                  "fixed": "e76bcb727e4874a2f9d0297f8e3f8eced89b0764"
                },
                {
                  "fixed": "4855a59e21789c79f003a9b5f4135c95a7495c6b"
                },
                {
                  "fixed": "33f486987af21531a7b18973d11795ede3da9ddd"
                },
                {
                  "fixed": "1aec30021edd410b986c156f195f3d23959a9d11"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31450.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.11.0"
                },
                {
                  "fixed": "5.10.253"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.203"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.168"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.134"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.81"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.21"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "6.19.11"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31450.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:43.760215927Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
        "https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11",
        "https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366",
        "https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9ddd",
        "https://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6b",
        "https://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adb",
        "https://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232",
        "https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17",
        "https://git.kernel.org/stable/c/e76bcb727e4874a2f9d0297f8e3f8eced89b0764",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31450.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-31450",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31450.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-31450",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 511605,
  "published_at": "2026-04-22T13:53:45.532+00:00"
}