CVE-2026-45985

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O

When allocating blocks during within-EOF DIO and writeback with

dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an

existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was

set when calling ext4_split_convert_extents(), which may potentially

result in stale data issues.

Assume we have an unwritten extent, and then DIO writes the second half.

[UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent

[UUUUUUUUUUUUUUUU] extent status tree

|<- ->| ----> dio write this range

First, ext4_iomap_alloc() call ext4_map_blocks() with

EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and

EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and

call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the

above flags set.

Then, ext4_split_convert_extents() calls ext4_split_e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References