Linux Kernel EUVD-2026-32358

Exploitation requires a local account on the target system (PR:L). The vulnerable code path triggers only on ext4 filesystems mounted WITHOUT the dioread_nolock option - dioread_nolock avoids the unwritten-extent allocation path that leads to this bug. A pre-allocated (unwritten) extent must exist in the filesystem, typically from a fallocate() call or a sparse file. A buffered write must be issued to the interior of this unwritten extent (not at its boundaries). Crucially, the system must experience transient memory or metadata resource exhaustion during the first ext4_split_extent_at() call - without this failure, the split completes normally and the bug is never triggered. These combined conditions (local access, specific mount option absent, unwritten extents present, memory pressure at the right moment) make opportunistic or remote exploitation infeasible. The 'Information Disclosure' tag in the input is inconsistent with CVSS C:N and the description - confidentiality breach should NOT be assumed as a condition or outcome.

The NVD-assigned CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates this as Medium severity. The local attack vector and PR:L requirement meaningfully limit the threat surface to users with local shell access on affected systems. EPSS at 0.02% (5th percentile) confirms negligible observed exploitation interest. The vulnerability is not listed in CISA KEV and no public proof-of-concept exploit has been identified. The high availability impact (A:H) reflects potential filesystem corruption or kernel panic stemming from the inconsistent extent state. Notably, the input tags list 'Information Disclosure,' which is inconsistent with the CVSS C:N rating - this appears to be an inaccurate tag; the actual impact per the description and CVSS is exclusively availability. The real-world risk is further constrained by the multi-condition trigger: ext4 without dioread_nolock, pre-allocated unwritten extents, buffered writes targeting the middle of those extents, and transient memory pressure sufficient to cause ext4_split_extent_at() to fail - making uncontrolled exploitation unlikely. This is a correctness/stability fix rather than a remotely exploitable security primitive.

A local user with a standard shell account on an unpatched Linux system running ext4 without dioread_nolock creates or accesses a large pre-allocated file (e.g., via fallocate), then performs a buffered write targeting the middle of the unwritten extent while the system is under memory pressure. If the kernel's ext4_split_extent_at() call at the upper split boundary fails and falls back to zeroing, the resulting stale extent status cache entry causes subsequent reads or writes to the affected file range to encounter inconsistent metadata, potentially triggering a kernel BUG_ON assertion or silent data integrity failure. No public proof-of-concept exploit exists at time of analysis.