LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1

In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and converting it to initialized, there is currently a potential issue of stale data if the extent needs to be split in the middle. 0 A B N [UUUUUUUUUUUU] U: unwritten extent [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and mark the entire extent from 0 to N as written. 0 A B N [WWWWWWWWWWWW] W: written extent [SSDDDDDDDDZZ] Z: zeroed, S: stale data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left a stale written extent from 0 to A. 0 A B N [WW|WWWWWWWWWW] [SS|DDDDDDDDZZ] Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at() when splitting at B, don't convert the entire extent to written and left it as unwritten after zeroing out B to N. The remaining work is just like the standard two-part split. ext4_split_extent() will pass the EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the second time, allowing it to properly handle the split. If the split is successful, it will keep extent from 0 to A as unwritten.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel ext4 bug can leave old disk contents exposed as valid file data after a failed extent split. The issue is in filesystem block handling, not a network service. Business risk depends on whether affected kernels use ext4 on systems where stale local data disclosure would matter.

Executive priority

Treat as a targeted kernel data-exposure issue. It is not currently evidenced as actively exploited, but should be included in normal kernel patch cycles and prioritized where local data separation matters.

Technical view

The ext4 extent-splitting path can zero part of an unwritten extent, mark the larger extent written, then later split successfully and leave stale data in the first range. The fix changes handling to use EXT4_EXT_DATA_PARTIAL_VALID1 so the untouched range remains unwritten.

Likely exposure

Exposure is limited to Linux systems using ext4 with affected kernel code. The source bundle’s affected version data is not clear enough to map every distribution kernel reliably, especially with vendor backports.

Exploitation context

The CVE is not marked KEV, and the supplied sources do not report active exploitation or public exploit tooling. The plausible impact is local stale data exposure through ext4 behavior under specific extent allocation or conversion conditions.

Researcher notes

Evidence supports a stale data exposure flaw in ext4 extent conversion. The bundle lacks CVSS, CWE, distro impact, and exploitability detail. Validation should focus on code lineage and vendor backports, not only upstream version strings.

Mitigation direction

  • Apply kernel or distribution updates containing the referenced ext4 stable fixes.
  • Prioritize shared, multi-user, container-host, and sensitive-data ext4 systems.
  • Check vendor advisories for backported fixed kernel versions.
  • Avoid assuming mainline version numbers map directly to distribution kernel safety.

Validation and detection

  • Inventory Linux hosts using ext4 filesystems.
  • Compare running kernels against vendor fixed versions or referenced stable commits.
  • Review storage-heavy workloads where unwritten extents and delayed I/O are common.
  • Confirm patched kernels are active after reboot, not only installed.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-45858 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdee1f973ca341c266229faa5a1a5bb268bed3531, dee1f973ca341c266229faa5a1a5bb268bed3531, dee1f973ca341c266229faa5a1a5bb268bed3531, dee1f973ca341c266229faa5a1a5bb268bed3531, dee1f973ca341c266229faa5a1a5bb268bed3531, 814a7833df19e1de7447f870ae890adb12561627, 4319fd00002630a761fa5559a086f11ed7623006, e28b27be06c5e6a5236c0c0b370ca0768ab086bb, 3.2.33, 3.4.16, 3.6.4unaffected
LinuxLinux3.7, 0, 6.6.130, 6.12.75, 6.18.14, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.