CVE-2026-45892 ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
A logic error in the Linux kernel ext4 filesystem can leave stale extent cache entries, potentially leading to data corruption or incorrect data reads during specific write operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45892?
CVE-2026-45892 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.
Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent.
0 A B N [UUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten.
0 A B N [UUUUUUUUUUUU] on-disk extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Z: zeroed data
ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N.
0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ]
Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree.
0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUWWWWWWWWUU] extent status tree [--DDDDDDDDZZ]
Fix this issue by always cached extent status entry after zeroing out the second part.
Which versions are affected by CVE-2026-45892?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45892?
Apply the vendor's patch.
Is CVE-2026-45892 being exploited?
There is no known exploitation of CVE-2026-45892 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88581, BELL-CVE-2026-45892, DEBIAN-CVE-2026-45892, GHSA-xq2x-f6m4-2hrp, ROOT-OS-DEBIAN-11-CVE-2026-45892, ROOT-OS-DEBIAN-12-CVE-2026-45892 and 3 more.