{
  "threat_severity" : "Important",
  "public_date" : "2026-05-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1",
    "id" : "2482100",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2482100"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-909",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\next4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1\nWhen allocating initialized blocks from a large unwritten extent, or\nwhen splitting an unwritten extent during end I/O and converting it to\ninitialized, there is currently a potential issue of stale data if the\nextent needs to be split in the middle.\n0  A      B  N\n[UUUUUUUUUUUU]    U: unwritten extent\n[--DDDDDDDD--]    D: valid data\n|<-  ->| ----> this range needs to be initialized\next4_split_extent() first try to split this extent at B with\nEXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but\next4_split_extent_at() failed to split this extent due to temporary lack\nof space. It zeroout B to N and mark the entire extent from 0 to N\nas written.\n0  A      B  N\n[WWWWWWWWWWWW]    W: written extent\n[SSDDDDDDDDZZ]    Z: zeroed, S: stale data\next4_split_extent() then try to split this extent at A with\nEXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left\na stale written extent from 0 to A.\n0  A      B   N\n[WW|WWWWWWWWWW]\n[SS|DDDDDDDDZZ]\nFix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at()\nwhen splitting at B, don't convert the entire extent to written and left\nit as unwritten after zeroing out B to N. The remaining work is just\nlike the standard two-part split. ext4_split_extent() will pass the\nEXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the\nsecond time, allowing it to properly handle the split. If the split is\nsuccessful, it will keep extent from 0 to A as unwritten.", "A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability occurs during the splitting of unwritten data blocks, where a portion of the data may be incorrectly marked as written while still containing stale, uninitialized information. A local attacker could potentially exploit this to access sensitive data that should have been zeroed out, leading to information disclosure." ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-45858\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45858\nhttps://lore.kernel.org/linux-cve-announce/2026052710-CVE-2026-45858-54e5@gregkh/T" ],
  "name" : "CVE-2026-45858",
  "csaw" : false
}