Skip to main content

Linux Kernel CVE-2026-45899

| EUVDEUVD-2026-32365 MEDIUM
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fm97-7qpp-598c
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local user account
  2. Delivery
    Write to ext4 filesystem causing extent fragmentation
  3. Exploit
    Induce allocation or I/O failure during extent split
  4. Execution
    Stale extents remain in extent status tree
  5. Persist
    Trigger subsequent filesystem operation on stale extents
  6. Impact
    Kernel panic / denial of service

Vulnerability Assessment

Exploitation Conditions

Exploitation requires a local account with write access to an ext4-formatted filesystem mounted on the vulnerable kernel. The failure condition is triggered during an extent-splitting operation, which occurs under fragmented write patterns; triggering it reliably also requires a concurrent error (e.g., ENOSPC or I/O error) during the split, adding implicit complexity. Non-default configurations are not required - any standard ext4 mount is potentially affected. Exploitation is limited by the need for local authenticated access and the requirement that a split operation fails, which is not directly controllable by an attacker without a concurrent storage fault or resource pressure condition. The vulnerability cannot be exploited remotely.
Impact

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 and accurately characterizes this as a local, low-complexity availability issue. EPSS at 0.02% (7th percentile) is consistent with a kernel internals stability bug unlikely to attract opportunistic exploitation. The vulnerability is NOT in CISA KEV and no proof-of-concept code is publicly referenced. The 'Information Disclosure' tag applied by the intelligence source appears inconsistent with the CVSS C:N rating and the description, which describes only stale cache state - this discrepancy should not drive elevated prioritization. Real-world risk is highest in multi-tenant or container environments where unprivileged users can perform heavy ext4 filesystem I/O that would stress the extent-split code path. However, triggering a failure in that path requires an underlying storage-level or allocation error to occur concurrently, adding implicit complexity not captured in AC:L. For most single-tenant workloads, this is a correctness/stability patch rather than a security emergency.
Exploit ScenarioDerived

A local user on a multi-tenant Linux host (e.g., a container host or shared filesystem server) performs rapid, concurrent write operations to an ext4 filesystem, inducing a fragmented extent layout that requires extent splitting. A concurrent storage-level error or resource exhaustion condition causes the split operation to fail mid-execution, leaving stale extent status entries. A subsequent read or truncate operation by any process referencing those extents dereferences invalid kernel state, triggering a kernel panic and system-wide denial of service.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 25, 2026

Availability impact via stale extent cache corruption in the Linux kernel's ext4 filesystem driver allows a local low-privileged user to trigger a kernel denial-of-service condition. When an ext4 extent-splitting operation fails mid-execution, stale entries are left in the extent status tree, which can cause subsequent filesystem operations to crash the kernel. No public exploit exists and EPSS probability sits at 0.02% (7th percentile), reflecting this as a stability bug rather than a targeted attack vector. Vendor-released patches are available across all active stable branches.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 5.10.253, 5.15.203, 6.6.130, 6.12.75, 6.18.14, 6.19.4, or 7.0 (or later in each respective stable series). Upstream fix commits are available at https://git.kernel.org/stable/c/120c6bd7ca9d3e80a968b758cbb3fbd67570f132 (5.10 branch), https://git.kernel.org/stable/c/6e54f8dfee359bbd58086c883ea8cffd5312999d, https://git.kernel.org/stable/c/337506dc652383c80839edb8d8dcdd8ff2129b4f, https://git.kernel.org/stable/c/808f3191498f300174523c54cab101e18795ae4e, https://git.kernel.org/stable/c/79b592e8f1b435796cbc2722190368e3e8ffd7a1, https://git.kernel.org/stable/c/31bf37cf53ede8145e2bc62da803d4506da92975, and https://git.kernel.org/stable/c/dc7c9b9d03a59a7fe483574531327e650a4b4adc. As a workaround for systems that cannot immediately be patched, mounting ext4 filesystems with the 'nodelalloc' option reduces the likelihood of triggering delayed allocation extent splits, though this has a performance trade-off and is not a guaranteed mitigation. Restricting untrusted local user access to writable ext4 filesystems reduces exposure in multi-tenant environments.

Affected VersionsENISA

Linux 0 <5.10.253
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <dc7c9b9d03a59a7fe483574531327e650a4b4adc
Linux patch: 6.6.130
Linux 0 <5.15.203
Linux patch: 6.12.75
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <79b592e8f1b435796cbc2722190368e3e8ffd7a1
Linux 0 <6.12.75
Linux patch: 5.15.203
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <120c6bd7ca9d3e80a968b758cbb3fbd67570f132
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <808f3191498f300174523c54cab101e18795ae4e
Linux patch: 6.18.14
Linux 0 <6.18.14
Linux patch: 5.10.253
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6e54f8dfee359bbd58086c883ea8cffd5312999d
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <31bf37cf53ede8145e2bc62da803d4506da92975
Linux patch: 7.0
Linux 0 <6.6.130
Linux 0 <6.19.4
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <337506dc652383c80839edb8d8dcdd8ff2129b4f
Linux patch: 6.19.4

Affected Packages

euvd linux fix: 5.10.253, 5.15.203, 6.6.130, 6.12.75, 6.18.14, 6.19.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the ext4 extent status tree, a radix-tree-based in-memory cache that maps logical block ranges to physical extents for efficient extent lookups. When an extent-splitting operation (used during write or truncate paths) fails after partially modifying tree state, the cleanup path previously did not drop affected extent entries from the cache. This left logically inconsistent entries in the status tree that could be used by subsequent block mapping operations, potentially triggering a kernel BUG() or NULL dereference. The root cause is incomplete cleanup on error paths - semantically matching CWE-459 (Incomplete Cleanup) even though no CWE is formally assigned. Affected products span all Linux kernel stable branches from the initial git commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) through the fixed versions, per CPE cpe:2.3:o:linux:linux_kernel.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local vector and low-privilege match ext4 requiring authenticated filesystem access; A:H reflects kernel crash potential; no confidentiality or integrity impact per description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 7.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 25, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ext4: drop extent cache when splitting extent fails

When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale extent entries remaining in the extent status tree. So drop all of the remaining potentially stale extents if the splitting fails.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel underlies the vast majority of server, cloud, and container deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45899 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/366141 REF https://git.kernel.org/stable/c/120c6bd7ca9d3e80a968b758cbb3fbd67570f132 REF https://git.kernel.org/stable/c/2943bdbcdef6f74d4235ad0e57b225104dcad8ab REF https://git.kernel.org/stable/c/31bf37cf53ede8145e2bc62da803d4506da92975 REF https://git.kernel.org/stable/c/337506dc652383c80839edb8d8dcdd8ff2129b4f REF https://git.kernel.org/stable/c/6e54f8dfee359bbd58086c883ea8cffd5312999d REF https://git.kernel.org/stable/c/79b592e8f1b435796cbc2722190368e3e8ffd7a1 REF https://git.kernel.org/stable/c/808f3191498f300174523c54cab101e18795ae4e REF https://git.kernel.org/stable/c/dc7c9b9d03a59a7fe483574531327e650a4b4adc

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy