PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45948 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's ext4 filesystem implementation, specifically within the `ext4_ext_shift_extents()` function. The issue occurs when the function obtains an extent path via `ext4_find_extent()` but returns immediately upon encountering a NULL extent in the while loop without releasing the allocated path, resulting in a memory leak. The fix ensures proper cleanup by jumping to the `out` label to release the path before returning. This vulnerability affects the ext4 filesystem's extent manipulation code, which is used during operations that shift extents. The vulnerability was resolved in the Linux kernel with patches backported to multiple stable branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

System administrators managing Linux systems with ext4 filesystems, particularly those performing operations that may trigger extent shifting; kernel maintainers and distribution packagers responsible for backporting security fixes; security teams monitoring for kernel-level resource exhaustion vulnerabilities.

Technical summary

The vulnerability exists in `ext4_ext_shift_extents()` in the Linux kernel's ext4 filesystem. When iterating through extents, if a NULL extent is encountered, the function previously returned immediately without releasing the extent path obtained via `ext4_find_extent()`. The fix redirects control flow to the `out` label to ensure proper path release. This is a resource leak vulnerability with medium defensive priority, as it could lead to memory exhaustion under specific filesystem operation patterns. The fix has been backported to multiple stable kernel branches as evidenced by the eight referenced commits.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant kernel patch from the stable Linux kernel branches to affected systems
  • Monitor kernel memory usage on systems utilizing ext4 filesystems with extent-shifting operations
  • Update to a patched kernel version once available through distribution channels
  • Review system logs for any indicators of memory pressure related to ext4 operations

Evidence notes

The vulnerability description is sourced from the official CVE record published by CVE.org and mirrored in NVD. The fix involves modifying `ext4_ext_shift_extents()` to ensure the extent path is released via the `out` label when a NULL extent is encountered. Multiple stable kernel branch commits are referenced, indicating widespread backporting of the fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45948 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45948

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45948 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45948

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/12615ab4bfb69678e5d961b28bb70040299e51b1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1bce219ee5512cf179ba40cf114945a14a16e21f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2f4b1052246ca646bb17bfe0f53df2fdf9729b58

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4a79fde8db7eba7f1128d971ceba4e3c9ac84aec

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7e807cb8603b7664fa630a696cd891d9a03c248d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/afc5e61e1a07b2b833bd72cbee36ecce9cd901e2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bd7b52557e4a3ccd7595fdb3a585f1257de57935

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.