A flaw in the ext4 file system’s extent handling exposes a stale unwritten extent in the status tree after a partial zero‑out operation. The bug occurs when an unwritten file is split during a write; the kernel may leave behind an entry that still records the extent as unwritten, although the corresponding on‑disk data has been initialized. This inconsistency can cause subsequent read or write operations to observe corrupted or lost data, which directly impacts the reliability and integrity of stored files.

The vulnerability is present in the Linux kernel’s ext4 implementation prior to the patch that removes the stale extent entry. All distributions that ship the kernel version containing this bug, regardless of release series, are affected until the kernel is updated to the fixed revision.

The exact CVSS score is not supplied, and the EPSS score is unavailable, so the exploitation probability cannot be quantified. The bug is a local‑system flaw that can be triggered by a user able to write to an unwritten file on an ext4 filesystem. Because it results in data corruption rather than code execution, the attack surface is limited to scenarios where the attacker can influence file contents, such as a privileged user or a compromised application. The fix is straightforward, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time.