CVE-2026-45858: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
In the Linux kernel, the following vulnerability has been resolved:
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
When allocating initialized blocks from a large unwritten extent, or
when splitting an unwritten extent during end I/O and converting it to
initialized, there is currently a potential issue of stale data if the
extent needs to be split in the middle.
0 A B N
[UUUUUUUUUUUU] U: unwritten extent
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with
EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but
ext4_split_extent_at() failed to split this extent due to temporary lack
of space. It zeroout B to N and mark the entire extent from 0 to N
as written.
0 A B N
[WWWWWWWWWWWW] W: written extent
[SSDDDDDDDDZZ] Z: zeroed, S: stale data
ext4_split_extent() then try to split this extent at A with
EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left
a stale written extent from 0 to A.
0 A B N
[WW|WWWWWWWWWW]
[SS|DDDDDDDDZZ]
Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at()
when splitting at B, don't convert the entire extent to written and left
it as unwritten after zeroing out B to N. The remaining work is just
like the standard two-part split. ext4_split_extent() will pass the
EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the
second time, allowing it to properly handle the split. If the split is
successful, it will keep extent from 0 to A as unwritten.
Security readout for executives and security teams
Plain-English summary
This Linux kernel ext4 bug can leave old disk contents exposed as valid file data after a failed extent split. The issue is in filesystem block handling, not a network service. Business risk depends on whether affected kernels use ext4 on systems where stale local data disclosure would matter.
Executive priority
Treat as a targeted kernel data-exposure issue. It is not currently evidenced as actively exploited, but should be included in normal kernel patch cycles and prioritized where local data separation matters.
Technical view
The ext4 extent-splitting path can zero part of an unwritten extent, mark the larger extent written, then later split successfully and leave stale data in the first range. The fix changes handling to use EXT4_EXT_DATA_PARTIAL_VALID1 so the untouched range remains unwritten.
Likely exposure
Exposure is limited to Linux systems using ext4 with affected kernel code. The source bundle’s affected version data is not clear enough to map every distribution kernel reliably, especially with vendor backports.
Exploitation context
The CVE is not marked KEV, and the supplied sources do not report active exploitation or public exploit tooling. The plausible impact is local stale data exposure through ext4 behavior under specific extent allocation or conversion conditions.
Researcher notes
Evidence supports a stale data exposure flaw in ext4 extent conversion. The bundle lacks CVSS, CWE, distro impact, and exploitability detail. Validation should focus on code lineage and vendor backports, not only upstream version strings.
Mitigation direction
Apply kernel or distribution updates containing the referenced ext4 stable fixes.
Prioritize shared, multi-user, container-host, and sensitive-data ext4 systems.
Check vendor advisories for backported fixed kernel versions.
Avoid assuming mainline version numbers map directly to distribution kernel safety.
Validation and detection
Inventory Linux hosts using ext4 filesystems.
Compare running kernels against vendor fixed versions or referenced stable commits.
Review storage-heavy workloads where unwritten extents and delayed I/O are common.
Confirm patched kernels are active after reboot, not only installed.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-45858 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
6Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 27, 2026, 12:15 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.