CVE-2026-45892
Awaiting Analysis Awaiting Analysis - Queue
ext4 extent cache stale unwritten extent vulnerability

Publication date: 2026-05-27

Last updated on: 2026-05-30

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache after doing PARTIAL_VALID1 zeroout When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent. Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent. 0 A B N [UUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten. 0 A B N [UUUUUUUUUUUU] on-disk extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Z: zeroed data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N. 0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree. 0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUWWWWWWWWUU] extent status tree [--DDDDDDDDZZ] Fix this issue by always cached extent status entry after zeroing out the second part.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-30
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-45892
EUVD
EUVD-2026-32358
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel ext4 *
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's ext4 filesystem. It occurs when splitting an unwritten extent (a range of blocks not yet initialized with data) in the middle and converting it to an initialized extent under certain flags. Due to a failure in splitting the extent because of temporary lack of space, the system zeroes out part of the extent but leaves the entire extent marked as unwritten in the extent status tree. Later, when the extent is split successfully at a different point, the extent status tree is updated only partially, leaving a stale unwritten extent entry that does not accurately reflect the actual state of the data blocks.

This stale unwritten extent in the extent status tree can cause inconsistencies between the on-disk extent and the extent status tree, potentially leading to incorrect handling of file data.

Impact Analysis

The impact of this vulnerability is related to data integrity and filesystem consistency. Because the extent status tree may contain stale unwritten extents that do not match the actual data on disk, it could lead to incorrect file data handling by the kernel.

This inconsistency might cause data corruption, unexpected behavior when reading or writing files, or potential loss of data integrity in affected filesystems using ext4.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart