CVE-2023-52786

What it actually does

Race condition in ext4_dio_write_iter allows concurrent writers to create inline data on an inode after the MAY_INLINE_DATA check but before the exclusive lock is held, triggering WARN_ON_ONCE in ext4_iomap_begin during direct I/O writes.

Why it matters to the business

Linux systems using ext4 with direct I/O may experience kernel warnings, write fallbacks, or instability under concurrent access; high prevalence in servers and Android devices increases operational risk and patch urgency.

How an attack unfolds

An attacker triggers multiple unaligned or concurrent DIO writes on the same ext4 inode while another writer creates inline data during the lock-upgrade window, causing the check to miss the inline state and hit the error path.

How to fix it

Upgrade the Linux kernel to commit e3b83d87c93eb6fc96a80b5e8527f7dc9f5a11bc or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm kernel version contains commit e3b83d87c93eb6fc96a80b5e8527f7dc9f5a11bc; run targeted fio or direct I/O workloads that previously triggered the race and verify absence of the ext4 inline data warning.

Typical attack path

1. Identify ext4 filesystem with direct I/O enabled workloads
2. Issue concurrent unaligned DIO writes to the same inode
3. Force a writer to create inline data during the shared-to-exclusive lock cycle
4. Trigger the WARN_ON_ONCE path in ext4_iomap_begin

How to detect it

Search kernel logs for the exact WARN_ON_ONCE(ext4_has_inline_data(inode)) message; correlate with processes performing direct I/O writes on ext4 inodes around the same timestamp.

What your security team should do

• Prioritize kernel upgrade on all ext4 systems within the next maintenance window
• Disable direct I/O on ext4 where feasible until patched
• Monitor for ext4_iomap_begin warnings in kernel logs
• Test patched kernels in staging before broad rollout