CVE-2026-89601 ext2: Fix lost inode updates for IS_SYNC inodes
A logic error in the Linux kernel ext2 filesystem causes lost inode updates for synchronous inodes, potentially leading to data inconsistency.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89601?
CVE-2026-89601 is a high-severity vulnerability in Linux, published on 11 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ext2: Fix lost inode updates for IS_SYNC inodes
ext2_setsize() and ext2_xattr_set2() had a construct like:
if (IS_SYNC(inode)) { sync_inode_metadata(inode, 1); } else { mark_inode_dirty(inode); }
which leads to lost inode updates for IS_SYNC inodes because sync_inode_metadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the inode dirty and *then* call sync_inode_metadata().
Which versions are affected by CVE-2026-89601?
How do I fix CVE-2026-89601?
Apply the vendor's patch.
Is CVE-2026-89601 being exploited?
There is no known exploitation of CVE-2026-89601 in the wild and no public exploit code.
Sources
Also known as AZL-100446, BELL-CVE-2026-89601, DEBIAN-CVE-2026-89601, GHSA-g65m-jqm9-5xv8, UBUNTU-CVE-2026-89601.