CVE-2026-92501

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: drain in-flight DIO before buffered write fallback

generic/746 started failing intermittently on ext3 (no-extent inodes).

The test triggers 'Page cache invalidation failure on direct I/O'

warnings and subsequent fsync returns -EIO. Adding a 50ms delay

between ext4_buffered_write_iter() and filemap_write_and_wait_range()

in ext4_dio_write_iter() makes the race almost always reproducible.

On no-extent inodes, DIO writes to holes cannot use unwritten extents,

so ext4_iomap_alloc() leaves m_flags=0 and ext4_map_blocks() returns 0.

The iomap layer then returns -ENOTBLK, causing fallback to buffered I/O.

The fallback path in ext4_dio_write_iter() calls

ext4_buffered_write_iter() which dirties pages, then does flush and

invalidate. However, there's an unprotected window between

ext4_buffered_write_iter() returning (with inode lock released) and

the subsequent flush+invalidate.

Concurrent async DIO completions from

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References