CVE-2026-45858

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1

When allocating initialized blocks from a large unwritten extent, or

when splitting an unwritten extent during end I/O and converting it to

initialized, there is currently a potential issue of stale data if the

extent needs to be split in the middle.

0 A B N

[UUUUUUUUUUUU] U: unwritten extent

[--DDDDDDDD--] D: valid data

|<- ->| ----> this range needs to be initialized

ext4_split_extent() first try to split this extent at B with

EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but

ext4_split_extent_at() failed to split this extent due to temporary lack

of space. It zeroout B to N and mark the entire extent from 0 to N

as written.

0 A B N

[WWWWWWWWWWWW] W: written extent

[SSDDDDDDDDZZ] Z: zeroed, S: stale data

ext4_split_extent() then try to split this exte

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References