A vulnerability in the Linux kernel ext4 filesystem was addressed to prevent stale data exposure when splitting unwritten extents during block… (CVE-2026-45858)
A vulnerability in the Linux kernel ext4 filesystem was addressed to prevent stale data exposure when splitting unwritten extents during block allocation. The issue involved improper zeroing and marking of extents, which could leave stale data in written extents. The fix ensures correct handling of extent splitting flags to avoid converting entire extents to written prematurely.
AI Analysis
Technical Summary
CVE-2026-45858 describes a vulnerability in the Linux kernel's ext4 filesystem where, during allocation of initialized blocks from large unwritten extents or splitting such extents at end I/O, stale data could remain due to improper extent splitting logic. Specifically, ext4_split_extent() would attempt to split an extent with flags that caused the entire extent to be zeroed and marked as written even if the split failed, leaving stale data in parts of the extent. The fix involves passing the EXT4_EXT_DATA_PARTIAL_VALID1 flag to ext4_split_extent_at() to prevent converting the entire extent to written prematurely and ensuring the extent remains unwritten after zeroing, allowing proper two-part splitting and avoiding stale data exposure.
Potential Impact
The vulnerability could result in stale data being exposed in ext4 filesystem blocks after extent splitting operations, potentially leading to data integrity issues or unintended data disclosure. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability, suggesting the issue could cause system instability or crashes related to filesystem operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information are provided, users should monitor the Microsoft Security Response Center and Linux kernel advisories for updates addressing CVE-2026-45858. Until a fix is available, cautious handling of ext4 filesystem operations involving large unwritten extents is advised.
A vulnerability in the Linux kernel ext4 filesystem was addressed to prevent stale data exposure when splitting unwritten extents during block… (CVE-2026-45858)
Description
A vulnerability in the Linux kernel ext4 filesystem was addressed to prevent stale data exposure when splitting unwritten extents during block allocation. The issue involved improper zeroing and marking of extents, which could leave stale data in written extents. The fix ensures correct handling of extent splitting flags to avoid converting entire extents to written prematurely.
CVSS v3.1
Score 5.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-45858 describes a vulnerability in the Linux kernel's ext4 filesystem where, during allocation of initialized blocks from large unwritten extents or splitting such extents at end I/O, stale data could remain due to improper extent splitting logic. Specifically, ext4_split_extent() would attempt to split an extent with flags that caused the entire extent to be zeroed and marked as written even if the split failed, leaving stale data in parts of the extent. The fix involves passing the EXT4_EXT_DATA_PARTIAL_VALID1 flag to ext4_split_extent_at() to prevent converting the entire extent to written prematurely and ensuring the extent remains unwritten after zeroing, allowing proper two-part splitting and avoiding stale data exposure.
Potential Impact
The vulnerability could result in stale data being exposed in ext4 filesystem blocks after extent splitting operations, potentially leading to data integrity issues or unintended data disclosure. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability, suggesting the issue could cause system instability or crashes related to filesystem operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information are provided, users should monitor the Microsoft Security Response Center and Linux kernel advisories for updates addressing CVE-2026-45858. Until a fix is available, cautious handling of ext4 filesystem operations involving large unwritten extents is advised.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-45858
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- 3.1
Threat ID: 6a18ab7be29bf47b50288d73
Added to database: 05/28/2026, 20:54:19 UTC
Last enriched: 06/26/2026, 23:39:14 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.