CVE-2024-26773

What it actually does

Race condition in ext4 block allocator allows mb_mark_used to allocate blocks from a group whose bitmap was marked corrupted between ext4_mb_good_group and ext4_mb_try_best_found, bypassing the corruption check.

Why it matters to the business

Local users can trigger filesystem corruption or repeated crashes on ext4 volumes, leading to data unavailability, extended recovery windows, and potential loss of recent writes on affected Linux systems.

How an attack unfolds

An attacker with local access triggers concurrent ext4 allocation and corruption-marking operations so that ac_b_ex is obtained from a still-good group view, then used after the bitmap is marked bad, causing allocation into a corrupted structure.

How to fix it

Upgrade the Linux kernel to the commit 21f8cfe79f776287459343e9cfa6055af61328ea or later stable releases that include the fix in ext4_mb_try_best_found and ext4_mb_good_group. Reboot after package installation and verify the new kernel is running.

How to confirm the fix worked

Confirm the running kernel contains commit 21f8cfe79f776287459343e9cfa6055af61328ea, then mount an ext4 filesystem and exercise allocation paths under concurrent load while monitoring for group bitmap corruption warnings in dmesg.

Typical attack path

1. Obtain local shell or process on target Linux system with ext4 filesystem mounted
2. Trigger parallel block allocation and group bitmap corruption marking paths
3. Force ext4_mb_try_best_found to reuse ac_b_ex after unlock gap
4. Cause mb_mark_used to modify a now-corrupted block bitmap
5. Repeat to amplify corruption or induce kernel oops

How to detect it

Review kernel logs for ext4 corruption messages around allocation functions and audit local processes performing heavy concurrent file writes on ext4 volumes near the time of any bitmap corruption events.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using ext4
• Apply updates within standard patch windows given low EPSS and no KEV listing
• Restrict local untrusted code execution where possible until patched
• Monitor vendor advisories for backported fixes in distribution kernels