# CVE-2026-45892: ext4: drop extent cache after doing PARTIAL_VALID1 zeroout

Status: published. Published: 2026-05-27. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

ext4: drop extent cache after doing PARTIAL_VALID1 zeroout

When splitting an unwritten extent in the middle and converting it to
initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and
EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.

Assume we have an unwritten file and buffered write in the middle of it
without dioread_nolock enabled, it will allocate blocks as written
extent.

       0  A      B  N
       [UUUUUUUUUUUU] on-disk extent      U: unwritten extent
       [UUUUUUUUUUUU] extent status tree
       [--DDDDDDDD--]                     D: valid data
          |<-  ->| ----> this range needs to be initialized

ext4_split_extent() first try to split this extent at B with
EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but
ext4_split_extent_at() failed to split this extent due to temporary lack
of space. It zeroout B to N and leave the entire extent as unwritten.

       0  A      B  N
       [UUUUUUUUUUUU] on-disk extent
       [UUUUUUUUUUUU] extent status tree
       [--DDDDDDDDZZ]                     Z: zeroed data

ext4_split_extent() then try to split this extent at A with
EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and
leave an written extent from A to N.

       0  A      B  N
       [UUWWWWWWWWWW] on-disk extent      W: written extent
       [UUUUUUUUUUUU] extent status tree
       [--DDDDDDDDZZ]

Finally ext4_map_create_blocks() only insert extent A to B to the extent
status tree, and leave an stale unwritten extent in the status tree.

       0  A      B  N
       [UUWWWWWWWWWW] on-disk extent      W: written extent
       [UUWWWWWWWWUU] extent status tree
       [--DDDDDDDDZZ]

Fix this issue by always cached extent status entry after zeroing out
the second part.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ ddf854e59166533b0f46ba32cd6cd9aca3197d1b; < 28db4bfc6f82fd20e2aadb7fc162244109a4eb31 (affected, git); ≥ 58ddae5d77b1db3a27b891c75a8fa120239ac092; < f0931a5c17005a0c4fc35bd1a001245effc3354b (affected, git); ≥ d17857b4fb9ba5745b59be0ef38fd532991fccbf; < d8ee559fccdef713f058cfe5f2c03dc9b18be3b1 (affected, git); ≥ d67c8ecf3d8fda9b8ef80e6f665d84b6d6ac9d88; < c2ee51d684adca7645e4aa74adca13f6750390bc (affected, git); ≥ 7015fcf473796e1d2d876f241bd9e0c36f3d4eef; < a1b962a821e7a52d48212ae269b45808b4411267 (affected, git); ≥ 1bf6974822d1dba86cf11b5f05498581cf3488a2; < 6d882ea3b0931b43530d44149b79fcd4ffc13030 (affected, git). Source: CNA: Linux
- Linux / Linux: ≥ 6.1.167; < 6.1.168 (affected, semver). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.16% as of 2026-11-06; percentile 5.27%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/28db4bfc6f82fd20e2aadb7fc162244109a4eb31 (CNA: Linux)

- https://git.kernel.org/stable/c/f0931a5c17005a0c4fc35bd1a001245effc3354b (CNA: Linux)

- https://git.kernel.org/stable/c/d8ee559fccdef713f058cfe5f2c03dc9b18be3b1 (CNA: Linux)

- https://git.kernel.org/stable/c/c2ee51d684adca7645e4aa74adca13f6750390bc (CNA: Linux)

- https://git.kernel.org/stable/c/a1b962a821e7a52d48212ae269b45808b4411267 (CNA: Linux)

- https://git.kernel.org/stable/c/6d882ea3b0931b43530d44149b79fcd4ffc13030 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-45892; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-45892; retrieved 2026-11-06; source updated Not reported

Revision: fc0b762bfb0407f9a543daac00c1ef4a0368ce85d7b0cf968d10d84f113b141c

Canonical: https://y2.dev/cve/CVE-2026-45892

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.