CVE-2026-45948: Linux Kernel ext4 Memory Leak Vulnerability

CVE-2026-45948 Overview

CVE-2026-45948 is a memory leak vulnerability in the Linux kernel's ext4 filesystem implementation. The flaw resides in the ext4_ext_shift_extents() function within the extent management code path. When the extent pointer is NULL inside the function's while loop, the function returns immediately without releasing the path structure previously obtained from ext4_find_extent(). This leaves allocated kernel memory unreferenced on each triggering operation. Repeated invocation of the vulnerable path can exhaust kernel memory over time. The issue has been resolved upstream by redirecting the early-return through the existing out label, which performs proper cleanup.

Critical Impact
Repeated triggering of the vulnerable code path can exhaust kernel memory, degrading system performance and potentially causing denial of service on affected Linux hosts.

Affected Products

Linux kernel ext4 filesystem subsystem
Linux distributions shipping vulnerable stable kernel branches
Systems where untrusted users can trigger FALLOC_FL_COLLAPSE_RANGE or FALLOC_FL_INSERT_RANGE operations on ext4

Discovery Timeline

2026-05-27 - CVE-2026-45948 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45948

Vulnerability Analysis

The defect is a classic kernel memory leak in the ext4 extent shifting logic. The ext4_ext_shift_extents() function performs extent tree manipulation when ranges are collapsed or inserted in a file. It first calls ext4_find_extent(), which allocates a path structure describing the traversal through the extent tree. The caller is responsible for releasing this path via ext4_free_ext_path() once the operation completes.

Inside the function's while loop, the code checks whether the current extent pointer is NULL. The original implementation handled this condition with a direct return, bypassing the cleanup code at the function's out label. Each occurrence of this condition leaks the path buffer, including any held buffer-head references.

The upstream fix replaces the direct return with a jump to out, ensuring ext4_free_ext_path() runs on every exit. Multiple stable branches received backported commits, including 2f4b1052246c, 12615ab4bfb6, bd7b52557e4a, and ca81109d4a8f.

Root Cause

The root cause is improper resource cleanup on an error or boundary path. The function allocated a path structure but failed to release it before returning when the extent pointer was NULL. This pattern is categorized as a kernel memory leak and falls under improper release of memory before removing the last reference.

Attack Vector

Local users who can perform fallocate() operations with FALLOC_FL_COLLAPSE_RANGE or FALLOC_FL_INSERT_RANGE on an ext4-backed file can trigger the vulnerable code path. Repeated invocation gradually consumes non-reclaimable kernel memory. The attack vector requires local access and the ability to write to an ext4 filesystem. No code execution or privilege escalation results directly from this defect, but sustained memory pressure can render a host unresponsive.

No verified public proof-of-concept is referenced in the available data. See the upstream commits for the precise code paths involved.

Detection Methods for CVE-2026-45948

Indicators of Compromise

Steady growth in kernel slab usage tied to ext4 extent path allocations, visible in /proc/slabinfo or via slabtop.
Unexplained reduction in MemAvailable on hosts running ext4 workloads that frequently call fallocate() with collapse or insert range flags.
Workloads or users repeatedly invoking fallocate -c or fallocate -i against ext4 files without a clear operational reason.

Detection Strategies

Audit fallocate() syscalls using auditd rules to record FALLOC_FL_COLLAPSE_RANGE (0x08) and FALLOC_FL_INSERT_RANGE (0x20) usage by non-administrative users.
Correlate kernel memory growth metrics with running kernel versions to identify hosts on unpatched stable branches.
Inspect installed kernel package versions against the fix commits listed in the upstream references.

Monitoring Recommendations

Monitor host memory telemetry for slow, monotonic increases in kernel slab consumption that do not correspond to user workload growth.
Alert on processes issuing high-frequency fallocate() calls on ext4 filesystems, particularly from unprivileged contexts.
Track kernel package inventory across the fleet to surface hosts still running pre-patch builds.

How to Mitigate CVE-2026-45948

Immediate Actions Required

Apply the patched stable kernel that contains the ext4_ext_shift_extents() cleanup fix from your Linux distribution.
Identify hosts running ext4 with the vulnerable kernel version and schedule reboots into the patched kernel.
Restrict the ability of untrusted users to perform range-collapsing or range-inserting fallocate() operations on shared ext4 volumes.

Patch Information

The fix is available in multiple stable kernel branches via the following commits: 12615ab4bfb6, 1bce219ee551, 2f4b1052246c, 4a79fde8db7e, 7e807cb8603b, afc5e61e1a07, bd7b52557e4a, and ca81109d4a8f. The fix routes the NULL extent branch through the existing out label so that ext4_free_ext_path() always runs.

Workarounds

Where patching is not immediately possible, limit local user access on systems exposing ext4 volumes to untrusted workloads.
Use filesystem quotas and cgroup memory limits to constrain the blast radius of resource-exhausting workloads.
Reboot long-running hosts periodically to reclaim leaked kernel memory until patches are deployed.

bash

# Verify the running kernel version and compare to your distribution's fixed build
uname -r

# Example: audit rule to log fallocate syscalls for later review
auditctl -a always,exit -F arch=b64 -S fallocate -k ext4-fallocate-monitor

# Inspect ext4-related slab allocations for unusual growth
grep -E 'ext4|extent' /proc/slabinfo