PT-2026-43852 · Linux+2 · Linux Kernel+2

CVE-2026-45985

·

Published

2026-05-27

·

Updated

2026-08-25

CVSS v3.1

7.0

High

VectorAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description An issue exists in the ext4 file system when allocating blocks during within-EOF Direct I/O (DIO) and writeback with dioread nolock enabled. When splitting a large unwritten extent, the ext4 map blocks() function calls ext4 split convert extents() with the EXT4 GET BLOCKS CONVERT flag set. If ext4 split extent at() fails to insert an extent due to a temporary lack of space (-ENOSPC), the system may zero out the first half of the extent but incorrectly mark the entire on-disk extent as written. This inconsistency between the on-disk extent and the extent status tree can expose stale data if the DIO operation fails to write data to the disk and the cached extent entry is removed.
Technical details involve the following functions:
  • ext4 iomap alloc()
  • ext4 map blocks()
  • ext4 split convert extents()
  • ext4 split extent()
  • ext4 split extent at()
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-45985
OESA-2026-2674
OESA-2026-2675
OPENSUSE-SU-2026:21388-1
SUSE-SU-2026:22521-1
SUSE-SU-2026:22522-1
SUSE-SU-2026:22665-1
SUSE-SU-2026:22666-1
SUSE-SU-2026:22742-1
SUSE-SU-2026:22769-1
SUSE-SU-2026:22812-1
SUSE-SU-2026:22835-1
SUSE-SU-2026:2799-1
SUSE-SU-2026:2800-1
SUSE-SU-2026:3594-1
USN-8567-1
USN-8574-1
USN-8574-2
USN-8574-3
USN-8575-1
USN-8575-2
USN-8575-3
USN-8576-1
USN-8576-2
USN-8595-1
USN-8595-2
USN-8595-3
USN-8596-1
USN-8597-1
USN-8606-1
USN-8607-1
USN-8608-1
USN-8609-1
USN-8610-1
USN-8619-1
USN-8620-1
USN-8620-2
USN-8620-3
USN-8620-4
USN-8665-1
USN-8668-1

Affected Products

Linuxmint
Linux Kernel
Ubuntu