CVE-2026-45892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: drop extent cache after doing PARTIAL_VALID1 zeroout

When splitting an unwritten extent in the middle and converting it to

initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and

EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.

Assume we have an unwritten file and buffered write in the middle of it

without dioread_nolock enabled, it will allocate blocks as written

extent.

0 A B N

[UUUUUUUUUUUU] on-disk extent U: unwritten extent

[UUUUUUUUUUUU] extent status tree

[--DDDDDDDD--] D: valid data

|<- ->| ----> this range needs to be initialized

ext4_split_extent() first try to split this extent at B with

EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but

ext4_split_extent_at() failed to split this extent due to temporary lack

of space. It zeroout B to N and leave the entire extent as unwritt

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References