Executive brief
A vulnerability was identified in the Linux kernel's ext4 filesystem that can lead to data inconsistency and errors in disk space accounting. When the system splits large blocks of data (extents) during certain write operations, it may incorrectly cache temporary 'holes' in the data map, leading the system to believe data is missing or misplaced. This could result in minor data corruption or system errors during heavy file operations, potentially impacting the reliability of stored information.
Technical details
A race condition or logic error exists in the ext4 filesystem's extent management. When `ext4_split_extent_at()` is called (e.g., during Direct I/O writes to an unwritten extent), the kernel may call `ext4_find_extent()` and `ext4_cache_extents()` while the extent status entry is being shrunk. This can cause a truncated range to be incorrectly inserted as a 'hole' (H) into the extent status tree. Subsequent delayed buffer writes may then re-insert extents into these 'holes', leading to incorrect space accounting and potential data inconsistency. The fix involves setting the `EXT4_EX_NOCACHE` flag during the split process to prevent caching of extents while they are being modified.
Affected products
- Linux Linux Kernel ext4 filesystem component
Timeline
- 2025-11-29: patched: Initial patch authored by Zhang Yi
- 2026-05-27: advisory: CVE-2026-45912 published in NVD
References
- https://git.kernel.org/stable/c/4c2d9dac4d328244f9365b0a1fa27ec802821820
- https://git.kernel.org/stable/c/5b1f4290453314e11cd8e15c7baa8a9b76c19b23
- https://git.kernel.org/stable/c/692103feca376ae4298c92aa8828015d20f1d87b
- https://git.kernel.org/stable/c/8302b5b4aacdbb378f7b1216bb2ee782b5142415
- https://git.kernel.org/stable/c/8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79
- https://git.kernel.org/stable/c/93b2ebbbcb2e63cfc21a1946dfe91d3aa7952036
- https://git.kernel.org/stable/c/96007fd3c106aea773c1afae2d6f64cceb6da208