CVE-2026-45892

Analyzed Analyzed - Analysis Complete

ext4 extent cache stale unwritten extent vulnerability

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache after doing PARTIAL_VALID1 zeroout When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent. Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent. 0 A B N [UUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten. 0 A B N [UUUUUUUUUUUU] on-disk extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Z: zeroed data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N. 0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree. 0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUWWWWWWWWUU] extent status tree [--DDDDDDDDZZ] Fix this issue by always cached extent status entry after zeroing out the second part.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45892

EUVD

EUVD-2026-32358

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.1.167

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ext4 filesystem. It occurs when splitting an unwritten extent (a range of blocks not yet initialized with data) in the middle and converting it to an initialized extent under certain flags. Due to a failure in splitting the extent because of temporary lack of space, the system zeroes out part of the extent but leaves the entire extent marked as unwritten in the extent status tree. Later, when the extent is split successfully at a different point, the extent status tree is updated only partially, leaving a stale unwritten extent entry that does not accurately reflect the actual state of the data blocks.

This stale unwritten extent in the extent status tree can cause inconsistencies between the on-disk extent and the extent status tree, potentially leading to incorrect handling of file data.

Impact Analysis

The impact of this vulnerability is related to data integrity and filesystem consistency. Because the extent status tree may contain stale unwritten extents that do not match the actual data on disk, it could lead to incorrect file data handling by the kernel.

This inconsistency might cause data corruption, unexpected behavior when reading or writing files, or potential loss of data integrity in affected filesystems using ext4.

Hi! I’m here to help you understand CVE-2026-45892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70