CVE-2026-45892 Overview
CVE-2026-45892 is a Linux kernel vulnerability in the ext4 filesystem. The flaw resides in ext4_split_extent() when handling unwritten extents with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags. Under specific conditions, the kernel can leave a stale unwritten extent in the extent status tree after a PARTIAL_VALID1 zeroout operation. This inconsistency between on-disk extent state and the in-memory extent status tree can produce filesystem corruption symptoms during buffered writes against unwritten files. The issue has been resolved upstream by always caching the extent status entry after zeroing out the second part of the extent.
Critical Impact
An inconsistency between on-disk extents and the extent status tree may cause incorrect block mapping decisions, potentially leading to data integrity issues on ext4 filesystems.
Affected Products
- Linux kernel ext4 filesystem driver
- Distributions shipping affected stable kernel branches prior to the referenced fix commits
- Systems performing buffered writes into unwritten extents without dioread_nolock
Discovery Timeline
- 2026-05-27 - CVE-2026-45892 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45892
Vulnerability Analysis
The vulnerability occurs during the split-and-convert workflow used by ext4 to transition unwritten extents to initialized state. When a buffered write targets a range in the middle of an unwritten extent without dioread_nolock enabled, ext4 allocates blocks as a written extent and calls ext4_split_extent() to split and convert the affected range.
The sequence proceeds in two attempts. First, ext4_split_extent_at() is invoked with the EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flags. If that call fails due to temporary lack of space, the code zeroes out the second portion (B to N) and leaves the entire extent as unwritten on disk.
The second attempt then splits at offset A with EXT4_EXT_DATA_VALID2 set. The split succeeds and produces a written extent from A to N on disk. However, ext4_map_create_blocks() only inserts the A-to-B mapping into the extent status tree. The B-to-N range remains cached as an unwritten extent, even though the on-disk state is now written.
Root Cause
The root cause is a missing extent status cache update after the PARTIAL_VALID1 zeroout path. The code path zeros the second part of the extent on disk but does not refresh the corresponding extent status tree entry, causing on-disk and in-memory views to diverge.
Attack Vector
This is a local filesystem consistency issue triggered by ordinary buffered write workloads against files containing unwritten extents. No remote vector is associated. Triggering the inconsistency requires specific allocator pressure that causes the first ext4_split_extent_at() call to fail.
No verified exploitation code is available. Refer to the upstream patches for the precise code paths involved: Kernel Git Commit 6d882ea3 and Kernel Git Commit f0931a5c.
Detection Methods for CVE-2026-45892
Indicators of Compromise
- Unexpected zero-filled regions appearing in files that previously held unwritten extents
- Kernel WARN_ON or filesystem assertions involving ext4_es_* or ext4_ext_* routines
- Discrepancies reported by e2fsck -fn between extent tree and extent status data
Detection Strategies
- Audit running kernel versions across Linux fleets and compare against the fixed stable releases referenced in the upstream commits
- Monitor kernel ring buffer (dmesg) for ext4 warnings related to extent splitting and zeroout operations
- Track filesystem integrity check results from scheduled e2fsck runs on systems with high allocator pressure
Monitoring Recommendations
- Centralize kernel log collection to surface ext4 anomalies in production hosts
- Alert on repeated ext4_split_extent related warnings or filesystem read errors
- Include kernel package versions in configuration baselines and review drift continuously
How to Mitigate CVE-2026-45892
Immediate Actions Required
- Identify Linux hosts running unpatched stable kernels susceptible to the ext4 extent split flaw
- Schedule kernel updates to a release that includes the upstream fix commits
- Prioritize systems with heavy buffered I/O workloads on ext4 volumes that use fallocate-created unwritten extents
Patch Information
The issue is fixed upstream by ensuring the extent status entry is always cached after zeroing out the second part of the extent. Apply the fix from the relevant stable branch commit: Kernel Git Commit 6d882ea3, Kernel Git Commit a1b962a8, Kernel Git Commit c2ee51d6, Kernel Git Commit d8ee559f, and Kernel Git Commit f0931a5c.
Workarounds
- No official workaround is published; updating the kernel is the supported remediation
- Reduce exposure by avoiding sustained low-free-space conditions that increase split allocation failures
- Run periodic offline e2fsck passes on critical ext4 volumes until patched kernels are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
