The flaw arises from ext4’s handling of unwritten extents during a partial zero‑out operation. When the kernel splits an unwritten extent in the middle and a temporary failure occurs, it leaves a stale unwritten extent entry in the on‑disk extent status tree. A later successful split creates a written extent over the same region, but the stale entry remains, causing a mismatch between the on‑disk data and the filesystem metadata. This can result in corrupted reads or writes to the affected file, directly damaging file integrity. The defect does not provide code execution or privilege escalation; it is purely a data corruption flaw. The likely attack vector, inferred from the description, is a local write to an unwritten file, as the kernel path that manages extents requires sufficient privilege to modify file metadata.

The vulnerability exists in all Linux kernels that include the ext4 file system with the unpatched extent‑split logic. Any distribution shipping a kernel containing this code path—regardless of release series—remains vulnerable until the fixed revision is installed. Exact affected version ranges are not disclosed in the vulnerability data, so administrators should treat any kernel prior to the patch as vulnerable.

The CVSS score of 7.0 indicates medium severity, and the EPSS score of <1% shows a very low likelihood of exploitation. Inferred from the description, the defect is a local‑system vulnerability that requires write access to an unwritten file; an attacker with local or privileged access can trigger it. The vulnerability does not grant denial of service or code execution, but it can corrupt data, potentially leading to application failures. It is not listed in CISA’s KEV catalog, implying no known widespread exploitation to date.