CVE-2026-45899: Linux Kernel ext4 Cache Vulnerability

CVE-2026-45899 Overview

CVE-2026-45899 is a Linux kernel vulnerability in the ext4 filesystem subsystem. When the kernel attempts to split an extent and the operation fails, it returns an error without cleaning up extents still being processed. This leaves stale extent entries in the extent status tree, causing filesystem state inconsistency.

The fix drops all remaining potentially stale extents when splitting fails, restoring consistent state in the extent status tree.

Critical Impact
Stale entries in the ext4 extent status tree can lead to filesystem inconsistency and unpredictable behavior on systems performing extent split operations.

Affected Products

Linux kernel ext4 filesystem (stable branches receiving the backported fixes)
Distributions shipping affected stable kernels prior to the patch
Systems using ext4 as a primary or auxiliary filesystem

Discovery Timeline

2026-05-27 - CVE-2026-45899 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45899

Vulnerability Analysis

The vulnerability resides in the ext4 filesystem extent management code in the Linux kernel. The ext4 driver maintains an in-memory extent status tree that caches mappings between logical and physical blocks. During filesystem operations such as writes or truncations, the kernel may need to split an existing extent into multiple smaller extents.

If the split operation encounters an error mid-process, the original code path returned the error immediately. It did not invalidate or drop extents that had already been partially processed. This left stale entries in the extent status tree that no longer reflected the actual on-disk layout.

The patch ensures that on failure the kernel drops the remaining potentially stale extents, preventing the in-memory tree from diverging from on-disk metadata.

Root Cause

The root cause is incomplete error handling in the extent split path within fs/ext4/extents.c and related files. When the split sequence aborted partway, the function exited without invoking cleanup logic for entries already touched. This is a kernel filesystem state-management defect rather than an input-validation flaw.

Attack Vector

No attack vector, exploit, or proof-of-concept has been published for CVE-2026-45899. The defect manifests through legitimate ext4 operations that trigger an extent split failure. Impact is limited to filesystem state inconsistency on the affected mount rather than remote exploitation or code execution.

The vulnerability mechanism is described in the kernel commit messages referenced below. See the Kernel Patch Commit 808f319 and the Kernel Patch Commit dc7c9b9 for the authoritative technical detail.

Detection Methods for CVE-2026-45899

Indicators of Compromise

Kernel log messages from ext4 reporting errors during extent operations, write failures, or filesystem inconsistencies.
Unexpected EIO or ENOSPC return codes correlated with extent split paths in workloads with heavy file extension or truncation activity.
fsck.ext4 reporting extent tree inconsistencies after a system event that involved extent split failures.

Detection Strategies

Inventory running kernel versions across Linux endpoints and servers, then compare them against the fixed commits in the stable branches.
Monitor dmesg and /var/log/kern.log for ext4-related error patterns that may indicate extent operations failing.
Run fsck.ext4 -n during maintenance windows to detect on-disk inconsistencies that may stem from prior in-memory tree divergence.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on ext4 error and warning events.
Track kernel package versions through configuration management and flag hosts running unpatched stable kernels.
Correlate filesystem error events with application failures to identify hosts requiring remediation prioritization.

How to Mitigate CVE-2026-45899

Immediate Actions Required

Apply the vendor kernel update from your Linux distribution as soon as it becomes available for your stable branch.
Identify hosts running affected ext4-based mounts and prioritize patching on systems with high write or truncation workloads.
Ensure recent, verified backups exist for filesystems where in-memory tree divergence may have already occurred.

Patch Information

The upstream fix has been backported across multiple Linux stable branches. The relevant commits are: Kernel Patch Commit 120c6bd, Kernel Patch Commit 31bf37c, Kernel Patch Commit 337506d, Kernel Patch Commit 6e54f8d, Kernel Patch Commit 79b592e, Kernel Patch Commit 808f319, and Kernel Patch Commit dc7c9b9. Install the patched kernel package supplied by your distribution and reboot to load the fixed image.

Workarounds

No supported workaround exists in the kernel itself. The fix must be applied through the kernel update.
Reduce exposure by limiting workloads that produce frequent extent splits on critical ext4 mounts until patching is complete.
Run fsck.ext4 on affected filesystems during scheduled downtime if errors are observed in kernel logs.

bash

# Verify the running kernel and update via the distribution package manager
uname -r

# Debian or Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')

# RHEL, CentOS Stream, or Rocky Linux
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot