The vulnerability occurs in the ext4 filesystem when a large unwritten extent is split. Instead of properly zeroing or preserving the stale portion, the kernel incorrectly marks the whole extent as written after a partial zero‑out. This results in stale, previously written data remaining accessible in the new extent. The flaw allows an attacker to read data that should have been discarded, effectively leaking sensitive information that lived in the blocks before the split operation. The weakness corresponds to poor handling of uninitialized or stale data and can lead to confidentiality violations.

All Linux kernel installations that have the ext4 filesystem and have not applied the upstream patch that fixes ext4_split_extent(). The specific patch versions are not enumerated here, but any kernel built from source before the merging of the described commit is susceptible. Users of standard distribution kernels that have not yet incorporated the fix should be considered affected.

The vulnerability can be exploited when the filesystem performs I/O operations that involve large unwritten extents, such as mounting a fresh filesystem or writing large files, or during normal read/write cycles that trigger extent splitting. Because the flaw is in the kernel's internal extent management, local privilege escalation is not required; any process able to read the affected block device can potentially read the stale data. However, no public exploit is documented and the EPSS score is not available, indicating the likelihood of widespread exploitation is low. The vulnerability is not listed in CISA's KEV catalog, further suggesting limited attacker interest.