{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-92501 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-92501 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-92501 and fix it if it is affected.\n\nWhat it is: CVE-2026-92501 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-92501 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-92501/ (Markdown: https://insights.sbomify.com/CVE-2026-92501/index.md)","id":"CVE-2026-92501","markdown":"https://insights.sbomify.com/CVE-2026-92501/index.md","name":"CVE-2026-92501","record":{"aliases":["AZL-102053","BELL-CVE-2026-92501","DEBIAN-CVE-2026-92501","GHSA-h82g-vj5r-m4jv","UBUNTU-CVE-2026-92501"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A race condition in the Linux kernel ext4 filesystem can cause I/O errors and potential denial of service during concurrent direct and buffered writes.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: drain in-flight DIO before buffered write fallback\n\ngeneric/746 started failing intermittently on ext3 (no-extent inodes).\nThe test triggers 'Page cache invalidation failure on direct I/O'\nwarnings and subsequent fsync returns -EIO. Adding a 50ms delay\nbetween ext4_buffered_write_iter() and filemap_write_and_wait_range()\nin ext4_dio_write_iter() makes the race almost always reproducible.\n\nOn no-extent inodes, DIO writes to holes cannot use unwritten extents,\nso ext4_iomap_alloc() leaves m_flags=0 and ext4_map_blocks() returns 0.\nThe iomap layer then returns -ENOTBLK, causing fallback to buffered I/O.\n\nThe fallback path in ext4_dio_write_iter() calls\next4_buffered_write_iter() which dirties pages, then does flush and\ninvalidate. However, there's an unprotected window between\next4_buffered_write_iter() returning (with inode lock released) and\nthe subsequent flush+invalidate.\n\nConcurrent async DIO completions from other threads can run\nkiocb_invalidate_post_direct_write() during this window. If pages have\nbeen re-dirtied, post-invalidation finds dirty pages and triggers the\nwarning, setting -EIO in the error sequence.\n\nConsider a file with two 4k extents: [hole][written]. Thread A does\nDIO to the written extent, while thread B does DIO spanning both:\n\n  kworker A (4k DIO, allocated block)    kworker B (8k DIO, fallback)\n  -----------------------------------    ----------------------------\n  inode_lock_shared()                    inode_lock_shared()\n  iomap_dio_rw():                        iomap_dio_rw():\n    kiocb_invalidate_pages -\u003e clean        iomap_begin -\u003e -ENOTBLK\n    submit_bio (async)                     dio-\u003esize = 0\n  inode_unlock_shared()                  inode_unlock_shared()\n\n  [bio pending in block layer]           /* fallback: lock released */\n                                         ext4_buffered_write_iter()\n                                           inode_lock(exclusive)\n                                           generic_perform_write()\n                                             -\u003e dirty pages [0, 8k]\n                                           inode_unlock(exclusive)\n\n                                         /* pages dirty, no lock */\n  [bio completes]                        filemap_write_and_wait_range()\n  iomap_dio_complete()                     -\u003e flush dirty pages\n    kiocb_invalidate_post_direct_write() invalidate_mapping_pages()\n      invalidate_inode_pages2_range()\n      -\u003e finds dirty page!\n      -\u003e dio_warn_stale_pagecache()\n      -\u003e errseq_set(-EIO)\n\nThis issue can be triggered through normal I/O paths, not just\nintentionally overlapping DIO writes from userspace. For example,\ngeneric/746 uses a loop device where multiple kworkers issue concurrent\nI/O to the backing file. Additionally, when block_size \u003c folio_size,\nnon-overlapping DIO writes that share a large folio can also trigger\nthe race.\n\nAdd inode_dio_wait() in ext4_buffered_write_iter() before\next4_write_checks() to drain all in-flight DIO. This ensures that\nall DIO clears existing pages before submitting IO (via\nkiocb_invalidate_pages()), all BIO waits for all DIO to complete\n(via inode_dio_wait()), and ext4_write_checks() observes the inode\nsize after all completed DIO so that ext4_block_zero_eof() does not\nrace with in-flight DIO, thus eliminating the race.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ext4: drain in-flight DIO before buffered write fallback","id":"CVE-2026-92501","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"ext4: clear stale xarray tags on folios skipped during writeback","id":"CVE-2026-92502"},"packages":[],"prev":{"headline":"ext4: use fsdata to track inline data write state and fix race","id":"CVE-2026-92500"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel ext4 filesystem can cause I/O errors and potential denial of service during concurrent direct and buffered writes.","url":"https://insights.sbomify.com/CVE-2026-92501/"}