CVE-2026-45912 Overview
CVE-2026-45912 is a Linux kernel vulnerability in the ext4 filesystem code. The flaw resides in how the kernel caches extents during the extent splitting process. Caching extents while a split is in progress can leave stale entries in the extent status tree. This produces incorrect filesystem state, including holes recorded where unwritten extents should exist.
The issue affects direct I/O (DIO) write paths that operate on unwritten extents. After a split, subsequent delayed buffered writes can re-insert delayed extents into the stale region, corrupting space accounting. The upstream fix prevents ext4_cache_extents() from running on extents currently undergoing a split.
Critical Impact
Stale extent status entries can lead to filesystem space accounting errors and potential data integrity issues on ext4 volumes.
Affected Products
- Linux kernel ext4 filesystem driver
- Linux distributions shipping affected stable kernel branches
- Systems performing direct I/O on ext4 unwritten extents
Discovery Timeline
- 2026-05-27 - CVE-2026-45912 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45912
Vulnerability Analysis
The vulnerability affects the ext4 filesystem extent management logic in the Linux kernel. Ext4 tracks file block allocations using extents, with an in-memory extent status tree mirroring on-disk state. When a process issues a direct I/O write that covers only part of an unwritten extent, the kernel must split that extent into written and unwritten portions.
During this split, ext4_split_extent_at() truncates the existing extent and inserts a new one. The existing status entry may shrink, and intermediate calls to ext4_find_extent() and ext4_cache_extents() can run before the split completes. These calls observe a transient state and insert the truncated range as a hole into the extent status tree.
After the split finishes, the hole entry is not corrected. A later delayed buffered write on the affected range reinserts a delayed extent, producing inconsistent space accounting. This is a transient state-tracking bug rather than a memory corruption issue, but it undermines filesystem integrity guarantees.
Root Cause
The root cause is improper caching of extents during an in-progress split operation. The extent status tree is mutated by both the splitting code path and the caching path, with no coordination preventing the cache from recording a transient view as authoritative state.
Attack Vector
Triggering the condition requires workloads that perform direct I/O against partial ranges of unwritten extents on ext4 volumes, followed by delayed buffered writes on the same file region. This is typically a local, unprivileged-user-triggerable condition on systems where ext4 is the root or data filesystem. No remote attack vector applies. See the kernel commit log for the patch detail.
Detection Methods for CVE-2026-45912
Indicators of Compromise
- Kernel messages or WARN_ON triggers from ext4 extent caching code paths
- Unexpected filesystem space accounting discrepancies on ext4 volumes
- Inconsistent du, df, and stat reporting for files using unwritten extents
Detection Strategies
- Audit installed kernel versions against the fixed commits listed in the stable kernel tree
- Monitor dmesg and journalctl -k output for ext4 warnings referencing extent status or ext4_cache_extents
- Run filesystem consistency checks with e2fsck -n on suspect ext4 volumes during scheduled maintenance windows
Monitoring Recommendations
- Centralize kernel logs and alert on ext4 subsystem warnings and stack traces
- Track kernel version inventory across the Linux fleet to identify hosts running pre-patch kernels
- Correlate workloads that combine direct I/O and delayed buffered writes with hosts showing filesystem anomalies
How to Mitigate CVE-2026-45912
Immediate Actions Required
- Identify Linux hosts running kernels without the fix applied and prioritize them for patching
- Apply the vendor-provided stable kernel update containing the ext4 fix
- Reboot patched systems to load the corrected kernel and verify the new version
Patch Information
The upstream fix removes extent caching during the split path in ext4_split_extent_at(). Patches are merged across multiple stable kernel branches. Reference commits include 4c2d9dac4d32, 5b1f42904533, 692103feca37, 8302b5b4aacd, 8b4b19a2f963, 93b2ebbbcb2e, 96007fd3c106, and 9a2b95cdaf07.
Workarounds
- No supported runtime workaround exists; patching the kernel is the required remediation
- For high-risk workloads, avoid mixing direct I/O and delayed buffered writes against the same file regions until patched
- Schedule offline e2fsck runs on ext4 volumes that have been exposed to the vulnerable code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
