On August 11, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published three new entries in its Known Exploited Vulnerabilities (KEV) catalog, all targeting the Linux kernel ext4 filesystem implementation.
The Vulnerabilities
CVE-2026-47517, CVE-2026-47516, CVE-2026-47515 — these three CVEs affect how the Linux kernel handles ext4 filesystem data structures in block device drivers. The vulnerabilities stem from improper validation of data structures passed from user space to kernel space.
Technical Details
The ext4 filesystem is the default filesystem for most Linux distributions. The vulnerabilities exist in the ext4 extent tree handling code. When a specially crafted device file is mounted or accessed, the kernel can be tricked into executing arbitrary code in kernel context.
Red Hat confirmed that these vulnerabilities are being actively exploited in the wild. The exploitation chain requires no authentication — an attacker with local access can elevate to kernel-level code execution, and in containerized environments, container escape to the host is possible.
Affected Versions
- Linux kernel 6.8.x branch
- Linux kernel 6.12.x branch
- Linux kernel 6.16.x branch
Patched versions are available in the mainline Linux kernel tree. Distribution maintainers have released updated kernels.
CISA Deadline
Federal civilian executive branch (FCEB) agencies must remediate these vulnerabilities by September 2, 2026. CISA encourages all organizations to apply mitigations promptly.
References
- CISA Cybersecurity Advisory AA26-304A
- Red Hat Security Advisory (linked from CISA advisory)