Cloudanix VulnDB

CVE-2026-98941

High · 7.0

CVSS

7.0

EPSS

0.1%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can cause computers to crash when encryption is turned on for certain storage setups.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in ext4_finish_bio during I/O completion for encrypted inodes when large folios are enabled, triggered by enabling encryption on an already-mounted ext4 filesystem.

Why it matters to the business

Local denial of service via kernel panic on Linux systems using ext4 encryption; recent publication and low exploit maturity reduce immediate risk but require prompt patching to avoid operational disruption.

How an attack unfolds

An attacker with local access enables the encrypt feature on a mounted ext4 filesystem that has large folios active, then performs write operations that trigger the ext4-rsv-conversion workqueue and subsequent NULL dereference crash.

How to fix it

Upgrade to Linux kernel v7.3 or later; apply backported patch that explicitly disables large folios on encrypted inodes similar to data journaling inodes.

How to confirm the fix worked

Verify kernel version >= v7.3; confirm large folio disablement on encrypted inodes via code review or mount-time checks; reproduce crash scenario in test environment to validate fix.

Typical attack path

  1. Obtain local user access on affected Linux kernel (v6.19-v7.2)
  2. Mount ext4 filesystem and enable encrypt feature post-mount
  3. Perform write I/O that engages large folio handling on encrypted inode
  4. Trigger ext4_end_io_rsv_work leading to ext4_finish_bio crash

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference at address 0000000000000028 combined with Workqueue: ext4-rsv-conversion and RIP ext4_finish_bio; examine dmesg or syslog for ext4_release_io_end call traces.

  • BUG: kernel NULL pointer dereference, address: 0000000000000028
  • Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
  • RIP: 0010:ext4_finish_bio+0xf7/0x3e0
  • ext4_release_io_end+0x51/0x110
  • ext4_end_io_end+0x4c/0xe0

What your security team should do

  • Prioritize upgrade to fixed kernel version within 30 days given recent disclosure
  • Audit ext4 filesystems for post-mount encryption enablement
  • Monitor for kernel oops involving ext4_finish_bio and ext4_end_io_rsv_work
  • Disable large folios globally if encryption is required until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mounted filesystem circumvents that check, and writing encrypted data results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work RIP: 0010:ext4_finish_bio+0xf7/0x3e0 Call Trace: ext4_release_io_end+0x51/0x110 ext4_end_io_end+0x4c/0xe0 ext4_end_io_rsv_work+0xb3/0x100 Fix this by disabling large folios on encrypted inodes, as is already done for inodes that use data journaling. This affects all kernels between v6.19 and v7.2, but it is not needed in v7.3, where the code was significantly refactored.

Affected packages

Ecosystem Package Introduced Fixed