Linux Kernel CVE-2026-45858

Requires a local user account with write permissions (PR:L per CVSS vector) to an ext4-formatted filesystem on an unpatched Linux kernel. The specific trigger condition is a transient ENOSPC failure occurring at the precise moment ext4_split_extent_at() attempts the first of two boundary splits on a large unwritten extent during I/O end-completion processing. Exploitation is further limited to: ext4 filesystems only (XFS, Btrfs, tmpfs, and other filesystem types are not affected); storage volumes operating near capacity so that the ENOSPC failure path is reachable; and I/O workloads that produce large unwritten extents subsequently converted via the two-part split path. Systems with ample free space on ext4 volumes are unlikely to trigger the vulnerable path. The stale-data read is only meaningful if prior sensitive allocations exist in the adjacent on-disk block range - this is environmentally dependent. Authentication requirements are confirmed as local low-privilege (PR:L) from the NVD CVSS vector.

The NVD CVSS score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) captures the local, low-privilege attack surface correctly but assigns C:N and I:N - a direct conflict with the 'Information Disclosure' tag and the CVE description, which explicitly describes stale data becoming readable and filesystem data being silently corrupted. The official score appears to undercount both confidentiality and integrity dimensions; this discrepancy should be verified against the final NVD entry. EPSS at 0.02% (5th percentile) aligns with expectation: the vulnerability requires local access, an ext4 filesystem, a specific I/O pattern with large unwritten extents, and a transient ENOSPC condition at the exact moment of extent splitting - none of which are remotely triggerable or easily weaponized at scale. The vulnerability is not listed in CISA KEV and no public proof-of-concept code has been identified. Despite Linux kernel's ubiquitous deployment, the narrow triggering conditions and local-only vector substantially limit real-world risk. This is best characterized as a correctness and reliability defect with a secondary security dimension rather than a standalone exploitation primitive.

A local user with write access to an ext4 volume that is near storage capacity writes a large file whose I/O completion triggers the unwritten-to-written extent conversion path. At the moment ext4_split_extent_at() attempts to split the extent at boundary B, a transient ENOSPC condition causes the split to fail; the buggy error path zero-fills B-to-N and marks the entire 0-to-N extent as written, exposing stale on-disk content in the 0-to-A region that was written by a prior process or user. The local user then reads the affected byte range of the file to obtain data from a previous allocation - such as cleared credentials, file fragments, or application state - without requiring any elevated privileges. No public exploit code exists for this scenario.