CVE-2026-45920: Linux Kernel ext4 Cluster Accounting Error

CVE-2026-45920 Overview

CVE-2026-45920 is a Linux kernel vulnerability in the ext4 filesystem implementation. The flaw causes a double decrement of the s_dirtyclusters_counter during error handling on filesystem shutdown. The issue surfaces when ext4_mb_mark_diskspace_used() returns an error and the caller ext4_mb_new_blocks() decrements the dirty clusters counter a second time. This produces an inconsistent counter state observable as a WARNING in ext4_put_super() at fs/ext4/super.c:1324.

Critical Impact
The dirty clusters counter can reach a value of -1, triggering kernel warnings and reflecting filesystem accounting corruption during shutdown-injection workloads such as fstests test generic/388.

Affected Products

Linux kernel ext4 subsystem (multiple stable branches, per upstream stable backports)
Distributions shipping affected mainline and stable kernels
Systems exercising ext4_mb_new_blocks() with shutdown injection or error injection paths

Discovery Timeline

2026-05-27 - CVE-2026-45920 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45920

Vulnerability Analysis

The defect resides in the ext4 multi-block allocator error path. When ext4_handle_dirty_metadata() returns an error from within ext4_mb_mark_context(), control returns to ext4_mb_mark_diskspace_used() with the changed value non-zero. The function does not exit early. Instead, it decrements both cluster counters and propagates the error upward.

The caller, ext4_mb_new_blocks(), then falls into the !ar->len cleanup path. That path decrements s_dirtyclusters_counter a second time, producing the inconsistency. The bug is a logic and ownership defect in the cluster reservation accounting rather than a memory safety issue. It surfaces under shutdown-injection workloads such as fstestsgeneric/388, which combines fsstress with random shutdown events.

Root Cause

The root cause is ambiguous ownership of cluster reservation release between ext4_mb_mark_diskspace_used() and ext4_mb_new_blocks(). Both functions decrement the dirty clusters counter on the same error path. The fix lifts the counter reduction to a single location in the caller, making ext4_mb_new_blocks() solely responsible for acquiring and releasing cluster reservations in the non-delalloc case.

Attack Vector

No remote or local exploitation primitive is described in the advisory. The condition reproduces under filesystem stress testing that combines workload generation with shutdown injection. The observable effect is a kernel warning and a corrupted dirty clusters count, which is an accounting and reliability defect.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is available. See the upstream commits linked under Patch Information for the exact source-level fix.

Detection Methods for CVE-2026-45920

Indicators of Compromise

Kernel WARNING in ext4_put_super() at fs/ext4/super.c:1324 during unmount or shutdown
s_dirtyclusters_counter observed with a negative value such as -1 in tracing output
Reproduction signal from fstests test generic/388 on affected kernels

Detection Strategies

Monitor kernel ring buffer (dmesg, journalctl -k) for ext4 warnings referencing ext4_put_super and dirty cluster accounting
Run fstests generic/388 against staging kernels to validate whether the dirty clusters double decrement reproduces
Track kernel package versions across the fleet and flag hosts running ext4 builds preceding the fix commits

Monitoring Recommendations

Forward kernel warnings and stack traces to a centralized log pipeline for review
Alert on repeated occurrences of ext4 WARNING events on production hosts
Correlate filesystem unmount errors with prior I/O error injection or storage faults

How to Mitigate CVE-2026-45920

Immediate Actions Required

Apply the upstream stable kernel update that includes the fix commits for the ext4 dirty clusters accounting
Validate the patched kernel against fstests generic/388 before broad rollout
Inventory hosts using ext4 with shutdown-injection or error-injection test harnesses and prioritize those for update

Patch Information

The fix consolidates dirty cluster counter management into ext4_mb_new_blocks() so that ext4_mb_mark_diskspace_used() no longer decrements the counter on error. Upstream stable backports are available in the following commits: Kernel Git Commit 3924aea, Kernel Git Commit 523d5a4, Kernel Git Commit 55576fa, Kernel Git Commit 61e3721, Kernel Git Commit 81982a1, Kernel Git Commit 94a8cea, Kernel Git Commit ca408af, and Kernel Git Commit dbc4e10.

Workarounds

Avoid running shutdown-injection test workloads on unpatched production kernels
Reboot affected hosts after observing the ext4_put_super warning to restore consistent counter state
Where feasible, schedule ext4 unmounts during quiescent periods to reduce the likelihood of error-path concurrency

bash

# Verify running kernel version and check for ext4 warnings
uname -r
dmesg | grep -i "ext4_put_super\|dirtyclusters"
# Apply distribution kernel update once available
# Debian/Ubuntu: apt update && apt upgrade linux-image-$(uname -r | cut -d- -f1)
# RHEL/CentOS:   dnf update kernel