# CVE-2021-47406: linux: In the Linux kernel, the following vulnerability has been resolved:  ext4: add error checking to ext4_ext_replay_set_...

CVE-2021-47406 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47406, released May 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2021-47406
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 21, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  ext4: add error checking to ext4_ext_replay_set_iblocks()  If the call to ext4_map_blocks() fails due to an corrupted file system, ext4_ext_replay_set_iblocks() can get stuck in an infinite loop.  This could be reproduced by running generic/526 with a file system that has inline_data and fast_commit enabled.  The system will repeatedly log to the console:  EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076  and the stack that it gets stuck in is:     ext4_block_to_path+0xe3/0x130    ext4_ind_map_blocks+0x93/0x690    ext4_map_blocks+0x100/0x660    skip_hole+0x47/0x70    ext4_ext_replay_set_iblocks+0x223/0x440    ext4_fc_replay_inode+0x29e/0x3b0    ext4_fc_replay+0x278/0x550    do_one_pass+0x646/0xc10    jbd2_journal_recover+0x14a/0x270    jbd2_journal_load+0xc4/0x150    ext4_load_journal+0x1f3/0x490    ext4_fill_super+0x22d4/0x2c00  With this patch, generic/526 still fails, but system is no longer locking up in a tight loop.  It's likely the root casue is that fast_commit replay is corrupting file systems with inline_data, and we probably need to add better error handling in the fast commit replay code path beyond what is done here, which essentially just breaks the infinite loop without reporting the to the higher levels of the code.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.14.12-1 | [DEBIAN-CVE-2021-47406](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47406.md) | May 21, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.14.12-1 | [DEBIAN-CVE-2021-47406](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47406.md) | May 21, 2024 |
| Linux | linux Debian 14 | 5.14.12-1 | [DEBIAN-CVE-2021-47406](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47406.md) | May 21, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.