CVE-2026-45912: ext4: don't cache extent during splitting extent
In the Linux kernel, the following vulnerability has been resolved:
ext4: don't cache extent during splitting extent
Caching extents during the splitting process is risky, as it may result
in stale extents remaining in the status tree. Moreover, in most cases,
the corresponding extent block entries are likely already cached before
the split happens, making caching here not particularly useful.
Assume we have an unwritten extent, and then DIO writes the first half.
[UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUUUUUU] extent status tree
|<- ->| ----> dio write this range
First, when ext4_split_extent_at() splits this extent, it truncates the
existing extent and then inserts a new one. During this process, this
extent status entry may be shrunk, and calls to ext4_find_extent() and
ext4_cache_extents() may occur, which could potentially insert the
truncated range as a hole into the extent status tree. After the split
is completed, this hole is not replaced with the correct status.
[UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUU|HHHHHHHH] extent status tree H: hole
Then, the outer calling functions will not correct this remaining hole
extent either. Finally, if we perform a delayed buffer write on this
latter part, it will re-insert the delayed extent and cause an error in
space accounting.
In adition, if the unwritten extent cache is not shrunk during the
splitting, ext4_cache_extents() also conflicts with existing extents
when caching extents. In the future, we will add checks when caching
extents, which will trigger a warning. Therefore, Do not cache extents
that are being split.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel ext4 filesystem bug. Under a specific write pattern, ext4 can keep stale extent state after splitting an unwritten extent, leading to incorrect space accounting. The provided sources do not show remote exploitation, privilege impact, data theft, or a public attack path.
Executive priority
Treat this as a kernel maintenance and storage reliability issue until vendor scoring is available. Prioritize patch validation for production Linux systems using ext4, especially where filesystem errors could affect service availability or data integrity.
Technical view
The ext4 code could cache extents while ext4_split_extent_at() is splitting them. That can leave a hole entry in the extent status tree where unwritten extent state should remain, then a later delayed buffered write can reinsert delayed state and trigger space accounting errors.
Likely exposure
Exposure is most relevant to Linux systems using ext4. The source bundle marks Linux kernel versions as affected and references stable kernel fixes, but it does not provide distro-specific package names, supported kernel ranges, or configuration prerequisites beyond the described ext4 write path.
Exploitation context
The bundle states CISA KEV status is false and provides no evidence of active exploitation. The described trigger involves filesystem write behavior, including direct I/O to part of an unwritten extent followed by delayed buffered writes. No exploit method or attacker requirements are stated.
Researcher notes
Evidence is limited to the CVE description and upstream stable references. No CVSS, CWE, exploitability assessment, or vendor package matrix is included. Avoid assuming remote reachability or privilege escalation without additional vendor analysis.
Mitigation direction
Check Linux vendor or distribution advisories for CVE-2026-45912.
Update to a kernel containing the referenced stable ext4 fixes.
Prioritize ext4-heavy production systems and storage workloads.
Monitor filesystem and kernel logs for ext4 accounting or extent warnings.
If patching is delayed, follow vendor guidance for interim risk reduction.
Validation and detection
Inventory Linux hosts using ext4 filesystems.
Map running kernels to vendor advisories for CVE-2026-45912.
Confirm patched kernels include the referenced stable commits.
Review kernel logs for ext4 errors after write-heavy workloads.
Track distro backports rather than relying only on upstream version numbers.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-45912 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 27, 2026, 12:17 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.