{"id":"CVE-2026-98941","kind":"vulnerability","aliases":["CVE-2026-98941"],"related":[],"title":"Linux kernel ext4: encrypted files on large folios crash the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't enable large folios on encrypted inodes\n\nCommit 709f0f1f1bf5 (\"ext4: add checks for large folio\nincompatibilities when BS > PS\") disables large folios at mount time\nif the \"encrypt\" feature is set. However, enabling that feature on a\nmounted filesystem circumvents that check, and writing encrypted data\nresults in a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work\n  RIP: 0010:ext4_finish_bio+0xf7/0x3e0\n  Call Trace:\n   ext4_release_io_end+0x51/0x110\n   ext4_end_io_end+0x4c/0xe0\n   ext4_end_io_rsv_work+0xb3/0x100\n\nFix this by disabling large folios on encrypted inodes, as is\nalready done for inodes that use data journaling.\n\nThis affects all kernels between v6.19 and v7.2, but it is not needed\nin v7.3, where the code was significantly refactored.","summary":"Enabling the encrypt feature on a mounted ext4 filesystem bypasses a mount-time check, so writing encrypted data can trigger a kernel NULL pointer dereference and crash. The fix disables large folios on encrypted inodes, as already done for data-journaling inodes.","severity":"unknown","cvss":null,"epss":0.0019,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ext4","file-servers","linux-kernel","runtime","self-hosted"],"not_affected_if":["encrypt-set-at-mkfs-or-mount","kernel-v7.3-or-later","no-ext4-encryption"],"how_to_check":"- `uname -r` to see whether the running kernel is between v6.19 and v7.2\n- `tune2fs -l /dev/sdX | grep features` to check whether the `encrypt` feature is enabled on a mounted ext4 filesystem\n- unknown whether the sources give a further exposure check","fix":"- Update the Linux kernel to a release that includes the ext4 encrypted-inode large folio fix; the exact version is unknown from the sources\n- Kernels from v7.3 onward are not affected by this bug, per the description","status":"open","published_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:03+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:58:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the ext4 encrypted-inode large folio fix; the exact version is unknown from the sources\n- Kernels from v7.3 onward are not affected by this bug, per the description","reach":"local","title":"Linux kernel ext4: encrypted files on large folios crash the system","impact":"low","summary":"Enabling the encrypt feature on a mounted ext4 filesystem bypasses a mount-time check, so writing encrypted data can trigger a kernel NULL pointer dereference and crash. The fix disables large folios on encrypted inodes, as already done for data-journaling inodes.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ext4","self-hosted","file-servers"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel crash from NULL pointer dereference while writing encrypted data","analyst_note":"Check the upstream kernel commit and stable backports for the exact fixed version numbers and whether a severity score exists; the NVD entry gave no severity.","how_to_check":"- `uname -r` to see whether the running kernel is between v6.19 and v7.2\n- `tune2fs -l /dev/sdX | grep features` to check whether the `encrypt` feature is enabled on a mounted ext4 filesystem\n- unknown whether the sources give a further exposure check","needs_analyst":true,"not_affected_if":["kernel-v7.3-or-later","no-ext4-encryption","encrypt-set-at-mkfs-or-mount"],"who_is_affected":"Systems running Linux kernels from v6.19 through v7.2 that write encrypted data to ext4 filesystems where the encrypt feature was enabled on an already-mounted filesystem. Kernels v7.3 and later are not affected, and systems that never enable the encrypt feature after mount are less exposed since mount-time checks still apply.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":3602,"output_tokens":698,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':157C,165C,171C,178C '-2026':13A,16A '-98941':14A,17A '0000000000000028':141C '0010':153C '709f0f1f1bf5':93C 'add':95C 'address':140C 'affect':200C 'alreadi':66B,191C 'bio':156C 'bs':102C 'bug':135C 'bypass':38B 'call':159C 'check':43B,96C,126C 'circumv':124C 'code':216C 'commit':92C 'convers':146C 'crash':9A,56B,134C 'cve':12A,15A 'data':47B,70B,130C,197C 'data-journ':69B 'derefer':54B,139C 'disabl':59B,104C,183C 'done':67B,192C 'enabl':29B,86C,117C 'encrypt':4A,31B,46B,63B,90C,112C,129C,187C 'end':148C,164C,168C,170C,174C 'ext4':3A,18B,36B,83C,94C,144C,147C,154C,161C,167C,173C 'ext4-rsv-conversion':143C 'featur':32B,113C,119C 'file':5A,20B 'file-serv':19B 'filesystem':37B,123C 'finish':155C 'fix':58B,180C 'folio':8A,61B,88C,99C,106C,185C 'follow':78C 'host':28B 'howev':116C 'incompat':100C 'inod':64B,72B,91C,188C,194C 'io':149C,163C,169C,175C 'journal':71B,198C 'kernel':2A,24B,51B,76C,136C,202C 'larg':7A,60B,87C,98C,105C,184C 'linux':1A,23B,75C 'linux-kernel':22B 'mount':35B,41B,108C,122C 'mount-tim':40B 'need':211C 'null':52B,137C 'pointer':53B,138C 'ps':103C 'refactor':219C 'releas':162C 'resolv':82C 'result':131C 'rip':152C 'rsv':145C,150C,176C 'runtim':25B 'self':27B 'self-host':26B 'server':21B 'set':115C 'signific':218C 'system':11A 'time':42B,109C 'trace':160C 'trigger':49B 'use':196C 'v6.19':204C 'v7.2':206C 'v7.3':213C 'vulner':79C 'work':151C,177C 'workqueu':142C 'write':45B,128C 'x4c/0xe0':172C 'x51/0x110':166C 'xb3/0x100':179C 'xf7/0x3e0':158C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels from v6.19 through v7.2 that write encrypted data to ext4 filesystems where the encrypt feature was enabled on an already-mounted filesystem. Kernels v7.3 and later are not affected, and systems that never enable the encrypt feature after mount are less exposed since mount-time checks still apply.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98941","severity":null,"published_at":"2026-10-23T13:17:15+00:00","modified_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98941","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98941","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}