Re: [SECURITY] e2fsprogs v1.47.4 Vulnerabilities — Orphan File & Extent Handling

["Theodore Tso" <tytso@mit.edu>]

On Fri, Apr 03, 2026 at 11:29:55AM +0000, 4fqr wrote:
> 
> I'm disclosing three security vulnerabilities in e2fsprogs v1.47.4
> affecting orphan file inode processing and extent tree
> validation. This follows responsible disclosure notification to the
> maintainer (Theodore Ts'o).

You notified me 45 seconds before sending this e-mail to linux-ext4,
which is a public mailing list.  (For future reference, essentially
all lists @vger.kernel.org are public, with the contents available at
https://lore.kernel.org.)

> Patches and coordination discussion will follow once the maintainer
> has reviewed.

Coordination discussion is moot at this point, because you've already
made your findings public.  I'll review them in detail in the next few
days, but it does appear that we are missing some checks in the
orphan_file handling, which whether or not they are exploitable by a
malicious attacker, are real bugs that should be fixed.

Cheers,

					- Ted