Executive brief
A vulnerability was identified in the Linux kernel's ext4 filesystem that could lead to data inconsistency. When the system attempts to write data to a specific type of file storage area (unwritten extents) and encounters a temporary lack of disk space, it may fail to correctly update its internal records. This results in 'stale' information in the system's memory cache, potentially causing the operating system to misinterpret which parts of a file contain valid data versus empty space.
Technical details
A race or logic error exists in the ext4 filesystem's extent management. When `ext4_split_extent()` attempts to split an unwritten extent and convert it to initialized using `EXT4_EXT_MAY_ZEROOUT` and `EXT4_EXT_DATA_VALID2` flags, a failure in `ext4_split_extent_at()` (due to ENOSPC or similar temporary errors) can lead to an inconsistent state. Specifically, if the second part of an extent is zeroed out but the split fails, the extent status tree may retain a stale unwritten status while the on-disk extent is marked as written. This inconsistency is resolved by ensuring the extent cache is dropped after a partial zeroout operation. The fix has been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel ext4 filesystem component
Timeline
- 2025-11-29: patched: Initial patch authored by Zhang Yi
- 2026-05-27: advisory: CVE-2026-45892 published by NVD
References
- https://git.kernel.org/stable/c/6d882ea3b0931b43530d44149b79fcd4ffc13030
- https://git.kernel.org/stable/c/a1b962a821e7a52d48212ae269b45808b4411267
- https://git.kernel.org/stable/c/c2ee51d684adca7645e4aa74adca13f6750390bc
- https://git.kernel.org/stable/c/d8ee559fccdef713f058cfe5f2c03dc9b18be3b1
- https://git.kernel.org/stable/c/f0931a5c17005a0c4fc35bd1a001245effc3354b