CVE-2026-89601: Linux Kernel ext2 Privilege Escalation

CVE-2026-89601 Overview

CVE-2026-89601 affects the Linux kernel's ext2 filesystem implementation. The vulnerability stems from lost inode metadata updates for inodes marked with the IS_SYNC flag. In ext2_setsize() and ext2_xattr_set2(), the code called sync_inode_metadata() on synchronous inodes without first marking them dirty. Because sync_inode_metadata() only performs work when the inode is already dirty, inode updates could be silently dropped. The result is filesystem metadata inconsistency on ext2 volumes configured with synchronous semantics, impacting data integrity guarantees that applications rely on.

Critical Impact
Silent loss of ext2 inode metadata updates on IS_SYNC inodes can lead to filesystem inconsistency and integrity violations for workloads that depend on synchronous write semantics.

Affected Products

Linux kernel ext2 filesystem
Distributions shipping vulnerable Linux kernel versions containing the pre-fix ext2_setsize() and ext2_xattr_set2() logic
Systems mounting ext2 volumes with synchronous options or files with the S (sync) attribute

Discovery Timeline

2026-09-11 - CVE-2026-89601 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89601

Vulnerability Analysis

The defect lives in the ext2 filesystem code paths that update inode state after truncation and extended attribute changes. Both ext2_setsize() and ext2_xattr_set2() used a conditional pattern that branched on the IS_SYNC(inode) macro. On the synchronous branch, the code invoked sync_inode_metadata(inode, 1) directly. On the non-synchronous branch, it called mark_inode_dirty(inode).

The problem is that sync_inode_metadata() writes inode metadata to disk only if the inode is already flagged dirty. Because the sync branch never called mark_inode_dirty() first, freshly modified inode state could bypass the writeback entirely. Updates to size, timestamps, or extended attribute references could be lost even though the application explicitly requested synchronous semantics.

Root Cause

The root cause is an ordering flaw in filesystem writeback logic classified as a kernel filesystem vulnerability. Marking an inode dirty and syncing its metadata are two distinct operations, and sync_inode_metadata() is not a superset of mark_inode_dirty(). The fix, per the upstream commits, unconditionally marks the inode dirty first and then calls sync_inode_metadata() on IS_SYNC inodes, ensuring the metadata is always persisted.

Attack Vector

A local user with write access to an ext2 filesystem can trigger the affected paths through normal filesystem operations that alter file size or extended attributes on IS_SYNC inodes. Repeated operations against a synchronous file may leave inode metadata inconsistent with on-disk data blocks. See the upstream fix commits for the corrected logic: Kernel Git Commit 356984d and Kernel Git Commit 5efb3350.

Detection Methods for CVE-2026-89601

Indicators of Compromise

Filesystem consistency check (e2fsck) reports mismatched inode sizes, timestamps, or extended attribute block references on ext2 volumes.
Applications relying on synchronous ext2 writes observe stale or missing metadata after crash recovery.
Kernel version in use predates the upstream fixes referenced in commits 356984d and 5efb3350.

Detection Strategies

Inventory Linux hosts and compare running kernel versions against the patched builds shipped by each distribution vendor.
Audit mount options for ext2 filesystems using sync and identify files carrying the S attribute via lsattr.
Monitor e2fsck output from scheduled filesystem checks for repeated inode-level inconsistencies.

Monitoring Recommendations

Collect kernel build strings and package inventory data into a centralized data lake for version-based vulnerability queries.
Alert on unexpected filesystem remount events or repeated e2fsck corrections targeting ext2 volumes.
Track file integrity on paths hosted by ext2 to detect drift between expected and observed metadata.

How to Mitigate CVE-2026-89601

Immediate Actions Required

Apply the latest kernel security update from your Linux distribution containing the ext2 fix commits.
Reboot affected hosts after patching to activate the corrected kernel filesystem code paths.
Run e2fsck on ext2 volumes that used synchronous semantics prior to patching to repair any latent inconsistencies.

Patch Information

The upstream fix modifies ext2_setsize() and ext2_xattr_set2() to unconditionally call mark_inode_dirty(inode) before invoking sync_inode_metadata(inode, 1) on IS_SYNC inodes. Reference commits: Kernel Git Commit 356984d and Kernel Git Commit 5efb3350. Consume the fix through your distribution's kernel package updates.

Workarounds

Where feasible, migrate workloads that require synchronous integrity guarantees from ext2 to ext4 or another modern filesystem until patching is complete.
Avoid setting the S (sync) attribute or the sync mount option on ext2 volumes on unpatched kernels.
Increase the frequency of scheduled e2fsck runs on ext2 volumes hosting critical data pending patch deployment.

bash

# Verify kernel version and check for ext2 sync mounts
uname -r
mount | grep -E 'type ext2.*sync'
lsattr -R /path/to/ext2/mount 2>/dev/null | grep -- '-S-'