---
id: CVE-2026-74308
title: 'ext4: fix kernel BUG in ext4_write_inline_data_end'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: fix kernel BUG in ext4_write_inline_data_end

  When the data=journal mount option is used, the ext4_journalled_write_end()
  function incorrectly calls ext4_write_in…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb <
    13db1ccae4d38f6d9296ee74aa1d39b429959ddb
  - >-
    Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb <
    260830a9a706f5d335398236fc788ce32f220de1
  - >-
    Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb <
    9808ae9fae996afa942bd963a39c9b1cdeebd0bd
  - >-
    Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb <
    f00f5c0dd55319bc33b76f72c853bda0e0a32eda
  - >-
    Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb <
    0ae42b51607240990614e0843f0d3529aaff62cc
  - >-
    Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb <
    ad09aa45965d3fafaf9963bc78109b73c0f9ac8d
  - Linux 3.8
published: '2026-08-15'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:29:41.200Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74308'
references:
  - url: 'https://git.kernel.org/stable/c/13db1ccae4d38f6d9296ee74aa1d39b429959ddb'
  - url: 'https://git.kernel.org/stable/c/260830a9a706f5d335398236fc788ce32f220de1'
  - url: 'https://git.kernel.org/stable/c/9808ae9fae996afa942bd963a39c9b1cdeebd0bd'
  - url: 'https://git.kernel.org/stable/c/f00f5c0dd55319bc33b76f72c853bda0e0a32eda'
  - url: 'https://git.kernel.org/stable/c/0ae42b51607240990614e0843f0d3529aaff62cc'
  - url: 'https://git.kernel.org/stable/c/ad09aa45965d3fafaf9963bc78109b73c0f9ac8d'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06711
ingestedAt: '2026-11-05T15:02:32.535Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix kernel BUG in ext4_write_inline_data_end

When the data=journal mount option is used, the ext4_journalled_write_end()
function incorrectly calls ext4_write_inline_data_end() without checking
if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode.

If a previous attempt to convert the inline data to an extent failed (e.g.
due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but
the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next
call to ext4_write_begin() will not prepare the inline data xattr for
writing, but ext4_journalled_write_end() will incorrectly attempt to write
to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in
ext4_write_inline_data() since i_inline_size was not expanded.

Fix this by ensuring that ext4_journalled_write_end() only calls
ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is
set, mirroring the behavior of ext4_write_end() and ext4_da_write_end().

## Affected

- `Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb < 13db1ccae4d38f6d9296ee74aa1d39b429959ddb`
- `Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb < 260830a9a706f5d335398236fc788ce32f220de1`
- `Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb < 9808ae9fae996afa942bd963a39c9b1cdeebd0bd`
- `Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb < f00f5c0dd55319bc33b76f72c853bda0e0a32eda`
- `Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb < 0ae42b51607240990614e0843f0d3529aaff62cc`
- `Linux >= 3fdcfb668fd78ec92d9bc2daddf1d41e2a8a30bb < ad09aa45965d3fafaf9963bc78109b73c0f9ac8d`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.