CVE-2026-74307: In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4_
Summary
A vulnerability in the Linux ext4 filesystem allowed a deadlock (situation where two processes wait forever for each other) when using the EXT4_IOC_MOVE_EXT ioctl (a system call that moves data between files) with a file from a different filesystem. The problem occurred because the filesystem validation happened too late, after locks were already acquired, creating a circular dependency with freeze operations.
Solution / Mitigation
Move the superblock validation check to occur before any lock acquisition. The source states: 'Moving the superblock check before any lock acquisition is both semantically correct and eliminates the circular dependency by ensuring that cross-filesystem donor fds are rejected before sb_writers or inode locks are taken.'
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-74307
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%