What’s Vulnerable › Vulnerabilities

CVE-2026-45899: ext4: drop extent cache when splitting extent fails

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-27 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache when splitting extent fails When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale extent entries remaining in the extent status tree. So drop all of the remaining potentially stale extents if the splitting fails.

Affected products

• Linux kernel: from 3.12 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.6.130; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4 — fixed in 5.10.253, 5.15.203, 6.6.130, 6.12.75, 6.18.14, 6.19.4
• Linux: 3.12 — fixed in 7.0

How to fix

Upgrade to a fixed version: Linux kernel 5.10.253, 5.15.203, 6.6.130, 6.12.75; Linux 7.0. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/120c6bd7ca9d3e80a968b758cbb3fbd67570f132
• https://git.kernel.org/stable/c/2943bdbcdef6f74d4235ad0e57b225104dcad8ab
• https://git.kernel.org/stable/c/31bf37cf53ede8145e2bc62da803d4506da92975
• https://git.kernel.org/stable/c/337506dc652383c80839edb8d8dcdd8ff2129b4f
• https://git.kernel.org/stable/c/6e54f8dfee359bbd58086c883ea8cffd5312999d
• https://git.kernel.org/stable/c/79b592e8f1b435796cbc2722190368e3e8ffd7a1
• https://git.kernel.org/stable/c/808f3191498f300174523c54cab101e18795ae4e
• https://git.kernel.org/stable/c/dc7c9b9d03a59a7fe483574531327e650a4b4adc

Get alerted when CVE-2026-45899 or the next vulnerability affects your stack