Medium 5.5Published Apr 22, 2026

CVE-2026-31451ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio

Updated under an hour ago (Oct 27, 2026, 11:30 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption. The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 46c7f254543dedcf134ad05091ed2b935a9a597d before 3462a3f0716d27af51896dc8688bcf0628fb17ee; from 46c7f254543dedcf134ad05091ed2b935a9a597d before 636e8d85a36ab6c31aafd04ee66a69b18eebee7b; from 46c7f254543dedcf134ad05091ed2b935a9a597d before af25a6affeac4919e8d8c5cccc01a9d53478447e; from 46c7f254543dedcf134ad05091ed2b935a9a597d before 65c6c30ce6362c1c684568744ea510c921a756cd; from 46c7f254543dedcf134ad05091ed2b935a9a597d before d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed; from 46c7f254543dedcf134ad05091ed2b935a9a597d before 823849a26af089ffc5dfdd2ae4b9d446b46a0cda; from 46c7f254543dedcf134ad05091ed2b935a9a597d before a7d600e04732a7d29b107c91fe3aec64cf6ce7f2; from 46c7f254543dedcf134ad05091ed2b935a9a597d before 356227096eb66e41b23caf7045e6304877322edf	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.8 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 7.0; 7.0; 7.0; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee
https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b
https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e
https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd	patch
https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed	patch
https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda	patch
https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2	patch
https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.