CVE-2026-43288: Linux Kernel Privilege Escalation Flaw

CVE-2026-43288 Overview

CVE-2026-43288 is a Linux kernel vulnerability in the ext4 filesystem subsystem caused by use of an uninitialized resource [CWE-908]. The flaw occurs because ext4_percpu_param_init() runs after ext4_mb_init() during filesystem mount. When mb_group_bb_bitmap_alloc() detects a corrupted block bitmap with the DOUBLE_CHECK macro enabled, ext4_mark_group_bitmap_corrupted() attempts to update sbi->s_freeclusters_counter before the per-CPU counter is initialized. The resulting page fault in percpu_counter_add_batch() triggers a kernel oops, producing a denial-of-service condition during mount of a crafted or corrupted ext4 volume.

Critical Impact
A local attacker with mount privileges or access to a malformed ext4 image can trigger a kernel panic, causing high availability impact on the affected system.

Affected Products

Linux Kernel (mainline) prior to the fix commits
Linux Kernel 7.0 release candidates rc1 through rc7
Stable kernel branches receiving backports referenced in the upstream advisories

Discovery Timeline

2026-05-08 - CVE-2026-43288 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43288

Vulnerability Analysis

The defect lives in the ext4 mount path within __ext4_fill_super(). With the DOUBLE_CHECK debug macro defined, mb_group_bb_bitmap_alloc() reads and validates each group's block bitmap during ext4_mb_init_backend(). When validation fails, ext4_validate_block_bitmap() calls ext4_mark_group_bitmap_corrupted(), which decrements sbi->s_freeclusters_counter through percpu_counter_add_batch().

At this point in the mount sequence, the per-CPU counters managed by ext4_percpu_param_init() have not been allocated. Dereferencing the uninitialized counter pointer triggers a page fault at an unmapped address such as ff110000fa2cc000, producing a kernel oops on the mounting task.

The issue is reproducible with mkfs.ext4 -F -q -b 1024 /dev/sda 5G, followed by tune2fs -O quota,project /dev/sda and mounting the device. Although DOUBLE_CHECK is a debug build option, the underlying ordering bug demonstrates an unsafe assumption about initialization sequence whenever a corrupted bitmap is encountered early in mount.

Root Cause

The root cause is initialization order [CWE-908]. ext4_mb_init() may invoke code paths that depend on per-CPU counters before ext4_percpu_param_init() has created them. Any corruption path encountered during multi-block allocator initialization will dereference an uninitialized counter.

Attack Vector

Exploitation requires local access and the ability to mount an ext4 filesystem. An attacker supplying a crafted ext4 image, or operating on a filesystem with corrupted block bitmaps, can force a kernel panic on mount. The vulnerability does not yield code execution or information disclosure, but availability impact is high on the affected host.

The ext4 mount oops manifests in percpu_counter_add_batch+0x13/0xa0, called from ext4_mark_group_bitmap_corrupted during ext4_validate_block_bitmap and mb_group_bb_bitmap_alloc. See the upstream commits in the Linux Kernel stable tree for the exact ordering change.

Detection Methods for CVE-2026-43288

Indicators of Compromise

Kernel oops messages referencing percpu_counter_add_batch in the call trace following an ext4 mount attempt
EXT4-fs error log entries citing ext4_validate_block_bitmap and bad block bitmap checksum immediately before a crash
Unexpected mount failures or system reboots correlated with attaching removable or user-supplied block devices

Detection Strategies

Monitor dmesg and /var/log/kern.log for EXT4-fs error entries paired with BUG: unable to handle page fault traces
Track kernel version inventory against the fixed commits referenced in the upstream advisories to identify unpatched hosts
Audit which user accounts or services possess CAP_SYS_ADMIN or mount privileges that could trigger the code path

Monitoring Recommendations

Alert on repeated mount failures of ext4 volumes, especially from non-root or automounted sources
Collect kernel crash dumps via kdump to confirm whether faults match the published call trace
Forward host telemetry to a centralized log platform to correlate mount events with system instability

How to Mitigate CVE-2026-43288

Immediate Actions Required

Apply the upstream fix that moves ext4_percpu_param_init() before ext4_mb_init() in __ext4_fill_super()
Update affected kernels to a stable release containing the referenced commits and reboot impacted systems
Restrict mount privileges and disable automatic mounting of untrusted removable media until patched

Patch Information

The fix is available in the Linux kernel stable tree across multiple branches. Review and apply the upstream commits: 0d5fcb063cda, 270564513489, 9e9fb259bcdd, aec095f3cc6c, and bf5b60952449.

Workarounds

Avoid mounting ext4 filesystems with known or suspected block bitmap corruption until the patch is applied
Run e2fsck -fy on suspect volumes from a patched rescue environment before mounting them read-write
Remove CAP_SYS_ADMIN and explicit mount privileges from non-administrative users to reduce local attack surface
Disable kernel builds with the DOUBLE_CHECK debug macro in production images

bash

# Verify the running kernel version and ext4 module status
uname -r
modinfo ext4 | grep -E 'filename|version'

# Inspect recent ext4 errors before mounting suspect volumes
dmesg --ctime | grep -i 'EXT4-fs error'

# Run a read-only filesystem check before mounting
e2fsck -nf /dev/sdX