CVE-2026-43065 - Vulnerability Details

- ext4: always drain queued discard work in ext4_mb_release()

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: always drain queued discard work in ext4_mb_release()

While reviewing recent ext4 patch[1], Sashiko raised the following
concern[2]:

> If the filesystem is initially mounted with the discard option,
> deleting files will populate sbi->s_discard_list and queue
> s_discard_work. If it is then remounted with nodiscard, the
> EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is
> neither cancelled nor flushed.

[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/
[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev

The concern was valid, but it had nothing to do with the patch[1].
One of the problems with Sashiko in its current (early) form is that
it will detect pre-existing issues and report it as a problem with the
patch that it is reviewing.

In practice, it would be hard to hit deliberately (unless you are a
malicious syzkaller fuzzer), since it would involve mounting the file
system with -o discard, and then deleting a large number of files,
remounting the file system with -o nodiscard, and then immediately
unmounting the file system before the queued discard work has a change
to drain on its own.

Fix it because it's a real bug, and to avoid Sashiko from raising this
concern when analyzing future patches to mballoc.c.

Published: 2026-05-05

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a logic flaw in the ext4 filesystem where queued discard work is not flushed or cancelled when a filesystem is remounted with the nodiscard option after previously being mounted with discard. The result is that pending discard jobs may be left unexecuted, meaning data that was deleted may not be fully discarded from the storage device. This flaw does not allow arbitrary code execution, but it can lead to loss or unintended persistence of data and potentially compromise data confidentiality. It corresponds to resource‑leak and improper resource ownership weaknesses (CWE-772).

Affected Systems

The bug applies to all Linux kernel releases using the ext4 filesystem prior to the inclusion of the patch that forces discard work drain on unmount. All Linux kernel products that ship the ext4 filesystem are affected.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require local control of the system to mount the filesystem with -o discard, delete files, remount with -o nodiscard, and immediately unmount before any drain completes. Because this sequence is difficult to orchestrate and does not provide external attack vectors, the likelihood of exploitation in the wild is low. The risk is mainly local data persistence or loss rather than remote compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< e96c2354b170aaa53300c8e8fd59e41b133160f7
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< c360e9d0def4f4ae03254a67c683103908555b75
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 1c82f863f090ab899085bdfade073313384b514b
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 9ee29d20aab228adfb02ca93f87fb53c56c2f3af

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,e96c2354b170aaa53300c8e8fd59e41b133160f7)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,c360e9d0def4f4ae03254a67c683103908555b75)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,1c82f863f090ab899085bdfade073313384b514b)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,9ee29d20aab228adfb02ca93f87fb53c56c2f3af)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ext4 drain‑work patch.
Until a kernel update is available, avoid switching between -o discard and -o nodiscard on the same mount. Use a single mode for the lifetime of the filesystem.
If mounting with discard, unmount the filesystem after deleting large numbers of files to ensure pending discards are drained.
Consider disabling discard entirely if data persistence or tamper‑resistance is a concern.

Generated by OpenCVE AI on May 7, 2026 at 04:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b
https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098
https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8
https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af
https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327
https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75
https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7
https://lore.kernel.org/linux-cve-announce/2026050532-CVE-2026-43065-4766@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43065
https://www.cve.org/CVERecord?id=CVE-2026-43065

History

Thu, 07 May 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-584

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026050532-CVE-2026-43065-4766@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43065 https://www.cve.org/CVERecord?id=CVE-2026-43065
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 05 May 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-584

Tue, 05 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the discard option, > deleting files will populate sbi->s_discard_list and queue > s_discard_work. If it is then remounted with nodiscard, the > EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is > neither cancelled nor flushed. [1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/ [2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev The concern was valid, but it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing. In practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it would involve mounting the file system with -o discard, and then deleting a large number of files, remounting the file system with -o nodiscard, and then immediately unmounting the file system before the queued discard work has a change to drain on its own. Fix it because it's a real bug, and to avoid Sashiko from raising this concern when analyzing future patches to mballoc.c.
Title		ext4: always drain queued discard work in ext4_mb_release()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098 https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8 https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327 https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75 https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-05T15:23:25.326Z

Updated: 2026-05-11T22:17:02.221Z

Reserved: 2026-05-01T14:12:55.981Z

Link: CVE-2026-43065

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-05T16:16:15.683

Modified: 2026-05-06T13:08:07.970

Link: CVE-2026-43065

Redhat

Severity : Moderate

Publid Date: 2026-05-05T00:00:00Z

Links: CVE-2026-43065 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-07T04:15:21Z

Weaknesses

CWE-772

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object