CVE-2026-31447
Published: 22 April 2026
Summary
CVE-2026-31447 is a high-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-31447 affects the Linux kernel's ext4 filesystem implementation. The vulnerability stems from the kernel's failure to reject mounting ext4 filesystems configured with the bigalloc feature when s_first_data_block is not equal to zero, a combination that is explicitly not supported.
A local attacker can exploit this issue with low attack complexity and no required privileges, though it necessitates user interaction, such as convincing a user to mount a crafted ext4 filesystem image. Per the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation enables high-impact compromise of confidentiality, integrity, and availability on the affected system.
Mitigation is provided through kernel patches in stable releases, as detailed in the referenced commits on git.kernel.org. These commits implement rejection of mounts for bigalloc-enabled ext4 filesystems where s_first_data_block != 0, resolving the unsupported configuration. Security practitioners should update to kernels incorporating these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24782
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel ext4 mount parsing flaw enables local privilege escalation via crafted filesystem image (T1068); requires user interaction to mount malicious file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely application of kernel patches that reject unsupported bigalloc ext4 mounts with s_first_data_block != 0 directly prevents exploitation of CVE-2026-31447.
Vulnerability scanning identifies Linux kernels vulnerable to CVE-2026-31447, enabling remediation before exploitation.
Establishing and enforcing secure kernel configuration settings restricts mounting of potentially malicious or unsupported ext4 filesystems.