In the Linux kernel, the following vulnerability has been resolved:
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
When allocating initialized blocks from a large unwritten extent, or
when splitting an unwritten extent during end I/O and converting it to
initialized, there is currently a potential issue of stale data if the
extent needs to be split in the middle.
0 A B N
[UUUUUUUUUUUU] U: unwritten extent
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with
EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but
ext4_split_extent_at() failed to split this extent due to temporary lack
of space. It zeroout B to N and mark the entire extent from 0 to N
as written.
0 A B N
[WWWWWWWWWWWW] W: written extent
[SSDDDDDDDDZZ] Z: zeroed, S: stale data
ext4_split_extent() then try to split this extent at A with
EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left
a stale written extent from 0 to A.
0 A B N
[WW|WWWWWWWWWW]
[SS|DDDDDDDDZZ]
Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at()
when splitting at B, don't convert the entire extent to written and left
it as unwritten after zeroing out B to N. The remaining work is just
like the standard two-part split. ext4_split_extent() will pass the
EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the
second time, allowing it to properly handle the split. If the split is
successful, it will keep extent from 0 to A as unwritten.
References
Configurations
Configuration 1 (hide)
|
History
25 Jun 2026, 21:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.7:rc7:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2 - Patch | |
| References | () https://git.kernel.org/stable/c/58ddae5d77b1db3a27b891c75a8fa120239ac092 - Patch | |
| References | () https://git.kernel.org/stable/c/7015fcf473796e1d2d876f241bd9e0c36f3d4eef - Patch | |
| References | () https://git.kernel.org/stable/c/d17857b4fb9ba5745b59be0ef38fd532991fccbf - Patch | |
| References | () https://git.kernel.org/stable/c/d67c8ecf3d8fda9b8ef80e6f665d84b6d6ac9d88 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
27 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 14:16
Updated : 2026-06-25 21:07
NVD link : CVE-2026-45858
Mitre link : CVE-2026-45858
CVE.ORG link : CVE-2026-45858
JSON object : View
Products Affected
linux
- linux_kernel
CWE