CVE-2026-72225

Summary

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

jbd2_journal_initialize_fast_commit() validates journal capacity by checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds j_last the subtraction wraps to a large value, bypassing the bounds check.

The resulting underflow corrupts j_last, j_fc_first, and j_free, leading to journal abort.

Fix by checking num_fc_blks against j_last before the subtraction, returning -EFSCORRUPTED.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < e144ad0250f77e23e28949587b8b57e40dc3b512affected
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 4b48dcb88bb9117e3d3f051175a9a8b7cff7f8b6affected
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < fb9b49618ed7296ebfad62a3835da8945f727001affected
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 4450dcaadf7d4aae8b6e4223b5d6ee4eb77097a9affected
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 78955fdce8ff654e6d33a2fa90882a1e7eb26330affected
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < a58fc10adf503969fec2007b5afe8987258046c4affected
LinuxLinux6866d7b3f2bb4f011041ba54c98b1584497fe2fd < 289a2ca0c9b7eae74f93fc213b0b971669b8683daffected
LinuxLinux5.10affected
LinuxLinux0 < 5.10unaffected
LinuxLinux5.15.212 <= 5.15.*unaffected
LinuxLinux6.1.178 <= 6.1.*unaffected
LinuxLinux6.6.145 <= 6.6.*unaffected
LinuxLinux6.12.97 <= 6.12.*unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References