LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45912: ext4: don't cache extent during splitting extent

In the Linux kernel, the following vulnerability has been resolved: ext4: don't cache extent during splitting extent Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases, the corresponding extent block entries are likely already cached before the split happens, making caching here not particularly useful. Assume we have an unwritten extent, and then DIO writes the first half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, when ext4_split_extent_at() splits this extent, it truncates the existing extent and then inserts a new one. During this process, this extent status entry may be shrunk, and calls to ext4_find_extent() and ext4_cache_extents() may occur, which could potentially insert the truncated range as a hole into the extent status tree. After the split is completed, this hole is not replaced with the correct status. [UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent [UUUUUUU|HHHHHHHH] extent status tree H: hole Then, the outer calling functions will not correct this remaining hole extent either. Finally, if we perform a delayed buffer write on this latter part, it will re-insert the delayed extent and cause an error in space accounting. In adition, if the unwritten extent cache is not shrunk during the splitting, ext4_cache_extents() also conflicts with existing extents when caching extents. In the future, we will add checks when caching extents, which will trigger a warning. Therefore, Do not cache extents that are being split.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel ext4 filesystem bug. Under a specific write pattern, ext4 can keep stale extent state after splitting an unwritten extent, leading to incorrect space accounting. The provided sources do not show remote exploitation, privilege impact, data theft, or a public attack path.

Executive priority

Treat this as a kernel maintenance and storage reliability issue until vendor scoring is available. Prioritize patch validation for production Linux systems using ext4, especially where filesystem errors could affect service availability or data integrity.

Technical view

The ext4 code could cache extents while ext4_split_extent_at() is splitting them. That can leave a hole entry in the extent status tree where unwritten extent state should remain, then a later delayed buffered write can reinsert delayed state and trigger space accounting errors.

Likely exposure

Exposure is most relevant to Linux systems using ext4. The source bundle marks Linux kernel versions as affected and references stable kernel fixes, but it does not provide distro-specific package names, supported kernel ranges, or configuration prerequisites beyond the described ext4 write path.

Exploitation context

The bundle states CISA KEV status is false and provides no evidence of active exploitation. The described trigger involves filesystem write behavior, including direct I/O to part of an unwritten extent followed by delayed buffered writes. No exploit method or attacker requirements are stated.

Researcher notes

Evidence is limited to the CVE description and upstream stable references. No CVSS, CWE, exploitability assessment, or vendor package matrix is included. Avoid assuming remote reachability or privilege escalation without additional vendor analysis.

Mitigation direction

  • Check Linux vendor or distribution advisories for CVE-2026-45912.
  • Update to a kernel containing the referenced stable ext4 fixes.
  • Prioritize ext4-heavy production systems and storage workloads.
  • Monitor filesystem and kernel logs for ext4 accounting or extent warnings.
  • If patching is delayed, follow vendor guidance for interim risk reduction.

Validation and detection

  • Inventory Linux hosts using ext4 filesystems.
  • Map running kernels to vendor advisories for CVE-2026-45912.
  • Confirm patched kernels include the referenced stable commits.
  • Review kernel logs for ext4 errors after write-heavy workloads.
  • Track distro backports rather than relying only on upstream version numbers.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-45912 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024, 107a7bd31ac003e42c0f966aa8e5b26947de6024unaffected
LinuxLinux3.12, 0, 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.