---
id: CVE-2026-72225
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

  jbd2_journal_initialize_fast_commit() validates journal capacity by
  checking (journal->j_last - nu…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

  jbd2_journal_initialize_fast_commit() validates journal capacity by
  checking (journal->j_last - nu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    aa90f00932bf572d6ef284c977c2a60b39c13bd6
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    e144ad0250f77e23e28949587b8b57e40dc3b512
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    fb9b49618ed7296ebfad62a3835da8945f727001
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    78955fdce8ff654e6d33a2fa90882a1e7eb26330
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    a58fc10adf503969fec2007b5afe8987258046c4
  - >-
    Linux >= 6866d7b3f2bb4f011041ba54c98b1584497fe2fd <
    289a2ca0c9b7eae74f93fc213b0b971669b8683d
  - Linux 5.10
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:15.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72225'
references:
  - url: 'https://git.kernel.org/stable/c/289a2ca0c9b7eae74f93fc213b0b971669b8683d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/78955fdce8ff654e6d33a2fa90882a1e7eb26330'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a58fc10adf503969fec2007b5afe8987258046c4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aa90f00932bf572d6ef284c977c2a60b39c13bd6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e144ad0250f77e23e28949587b8b57e40dc3b512'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb9b49618ed7296ebfad62a3835da8945f727001'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00177
epssPercentile: 0.07208
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:44:09.066812Z'
ingestedAt: '2026-10-16T19:46:24.421Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

jbd2_journal_initialize_fast_commit() validates journal capacity by
checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS).
Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds
j_last the subtraction wraps to a large value, bypassing the bounds
check.

The resulting underflow corrupts j_last, j_fc_first, and j_free,
leading to journal abort.

Fix by checking num_fc_blks against j_last before the subtraction,
returning -EFSCORRUPTED.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.