The bug in ext4 occurs when the kernel splits a large unwritten extent, causing stale data that was previously written to remain accessible after a partial zero‑out operation. An attacker can read data that should have been discarded, exposing sensitive information that existed on the block device. This reflects an information exposure flaw coupled with stale data handling (CWE‑909).

All Linux kernel builds that include the ext4 filesystem and have not incorporated the upstream patch fixing ext4_split_extent(). The description does not list specific kernel version numbers, so any kernel compiled before the commit was merged is potentially impacted, including distributions that have not yet released an updated package.

The CVSS score of 7.0 denotes a medium‑severity vulnerability. The EPSS score is very low, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited active exploitation. Based on the description, it is inferred that exploitation requires a process that can read the block device involved, and no explicit privileged escalation is required. Successful exploitation would occur during normal read/write activity that triggers extent splitting, allowing the attacker to retrieve stale data that remains on disk after the partition operation.