CVE-2026-43065 - Vulnerability Details

- ext4: always drain queued discard work in ext4_mb_release()

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: always drain queued discard work in ext4_mb_release()

While reviewing recent ext4 patch[1], Sashiko raised the following
concern[2]:

> If the filesystem is initially mounted with the discard option,
> deleting files will populate sbi->s_discard_list and queue
> s_discard_work. If it is then remounted with nodiscard, the
> EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is
> neither cancelled nor flushed.

[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/
[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev

The concern was valid, but it had nothing to do with the patch[1].
One of the problems with Sashiko in its current (early) form is that
it will detect pre-existing issues and report it as a problem with the
patch that it is reviewing.

In practice, it would be hard to hit deliberately (unless you are a
malicious syzkaller fuzzer), since it would involve mounting the file
system with -o discard, and then deleting a large number of files,
remounting the file system with -o nodiscard, and then immediately
unmounting the file system before the queued discard work has a change
to drain on its own.

Fix it because it's a real bug, and to avoid Sashiko from raising this
concern when analyzing future patches to mballoc.c.

Published: 2026-05-05

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is a logic bug in the ext4 filesystem that leaves queued discard operations pending when a filesystem is remounted from discard to nodiscard. Because the pending discard work is not cancelled or flushed, deleted data may remain on storage, potentially exposing sensitive data. This weakness corresponds to CWE-772.

Affected Systems

It affects all Linux kernel releases that contain ext4 before the patch that forces discard work to drain on unmount. All distributions shipping those kernel versions are impacted.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is <1%. The solution is not listed in CISA KEV. The attack vector is inferred to be local; it requires an attacker to control the machine, mount and remount the ext4 volume with specific options, delete files, and unmount before the kernel can drain the discard queue. Because the required sequence is complex and requires direct volume management, the exploitation likelihood is low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< e96c2354b170aaa53300c8e8fd59e41b133160f7
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< c360e9d0def4f4ae03254a67c683103908555b75
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 1c82f863f090ab899085bdfade073313384b514b
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327
`55cdd0af2bc5ffc92a2deb745627755aecd5db33`	affected	< 9ee29d20aab228adfb02ca93f87fb53c56c2f3af

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,e96c2354b170aaa53300c8e8fd59e41b133160f7)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,c360e9d0def4f4ae03254a67c683103908555b75)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,1c82f863f090ab899085bdfade073313384b514b)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327)`	affected	code_commit	—
`[55cdd0af2bc5ffc92a2deb745627755aecd5db33,9ee29d20aab228adfb02ca93f87fb53c56c2f3af)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ext4 drain‑work patch.
Refrain from toggling between -o discard and -o nodiscard on the same filesystem mount; maintain a consistent discard mode during the filesystem lifetime.
Ensure that when discard is used, all pending discard work is allowed to drain before unmounting the filesystem, especially after deleting large volumes of data.

Generated by OpenCVE AI on May 29, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00116.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b
https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098
https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8
https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af
https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327
https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75
https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7
https://lore.kernel.org/linux-cve-announce/2026050532-CVE-2026-43065-4766@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43065
https://www.cve.org/CVERecord?id=CVE-2026-43065

History

Fri, 29 May 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

Thu, 07 May 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-584

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026050532-CVE-2026-43065-4766@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43065 https://www.cve.org/CVERecord?id=CVE-2026-43065
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 05 May 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-584

Tue, 05 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the discard option, > deleting files will populate sbi->s_discard_list and queue > s_discard_work. If it is then remounted with nodiscard, the > EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is > neither cancelled nor flushed. [1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/ [2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev The concern was valid, but it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing. In practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it would involve mounting the file system with -o discard, and then deleting a large number of files, remounting the file system with -o nodiscard, and then immediately unmounting the file system before the queued discard work has a change to drain on its own. Fix it because it's a real bug, and to avoid Sashiko from raising this concern when analyzing future patches to mballoc.c.
Title		ext4: always drain queued discard work in ext4_mb_release()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098 https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8 https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327 https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75 https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-05T15:23:25.326Z

Updated: 2026-05-11T22:17:02.221Z

Reserved: 2026-05-01T14:12:55.981Z

Link: CVE-2026-43065

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-05T16:16:15.683

Modified: 2026-05-29T18:20:50.683

Link: CVE-2026-43065

Redhat

Severity : Moderate

Publid Date: 2026-05-05T00:00:00Z

Links: CVE-2026-43065 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-29T20:30:07Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object