# CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

> A local attacker can cause a kernel deadlock in the ext4 filesystem by triggering a race condition with the EXT4_IOC_MOVE_EXT ioctl and a filesystem freeze.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-96462, BELL-CVE-2026-74307, DEBIAN-CVE-2026-74307, GHSA-j6rh-x9jg-pr3v, UBUNTU-CVE-2026-74307

## What is CVE-2026-74307?

CVE-2026-74307 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not
belong to the same superblock as the original file.  Currently, this
validation is performed inside ext4_move_extents() by
mext_check_validity(), but only after lock_two_nondirectories() has
already acquired the inode locks.  When the donor fd refers to a file
on a different filesystem (e.g., overlayfs), this late validation
creates a circular lock dependency:

  CPU0 (overlayfs write)            CPU1 (ext4 ioctl)
  ----                              ----
  inode_lock(ovl_inode)
                                    mnt_want_write_file(filp)
                                      sb_start_write(ext4_sb)   [sb_writers]
    backing_file_write_iter()
      vfs_iter_write(real_file)
        file_start_write(real_file)
          sb_start_write(ext4_sb)   [blocked by freeze]
                                    lock_two_nondirectories()
                                      inode_lock(ovl_inode)     [blocked]

With a concurrent freeze operation holding sb_writers write side, this
forms a deadlock cycle: CPU0 waits for freeze to complete, freeze waits
for CPU1's sb_writers reader to exit, CPU1 waits for CPU0's inode lock.

Since EXT4_IOC_MOVE_EXT exchanges physical extents between two files,
it fundamentally requires both files to reside on the same ext4
filesystem.  Moving the superblock check before any lock acquisition
is both semantically correct and eliminates the circular dependency
by ensuring that cross-filesystem donor fds are rejected before
sb_writers or inode locks are taken.

## Which versions are affected by CVE-2026-74307?


## How do I fix CVE-2026-74307?

Apply the vendor's patch.

## Is CVE-2026-74307 being exploited?

There is no known exploitation of CVE-2026-74307 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74307 and fix it if it is affected.

What it is: CVE-2026-74307 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74307 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74307/ (Markdown: https://insights.sbomify.com/CVE-2026-74307/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74307
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74307
- OSV: https://osv.dev/vulnerability/CVE-2026-74307

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74307/
Summaries are generated and may contain mistakes; the official description above is the record.