The Linux kernel’s ext4 filesystem contains a flaw where extents are cached during the split operation even though the corresponding on‑disk extent is being divided. This results in a hole being inserted into the extent status tree that is later never replaced. When the delayed buffer write re‑inserts the extent, the file system’s space accounting becomes incorrect. The incorrect accounting could cause file size mismatches, lost or corrupted data, and may trigger filesystem corruption or a denial‑of‑service if the metadata becomes inconsistent. The weakness is a failure to enforce proper resource handling (CWE‑372).

All Linux kernel builds that include the ext4 filesystem and that have not yet incorporated the patch from commit 4c2d9dac4d328244f9365b0a1fa27ec802821820 are affected. The CVE description does not list specific release versions, so any kernel version older than the patched commit that is still in use is potentially vulnerable.

The CVSS score is 5.5, indicating a moderate impact. The EPSS score is less than 1%, showing a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so it has not been publicly exploited. Yet the attack vector is likely local or privileged; an attacker with write access to the affected ext4 volume or who can trigger the delayed write mechanism could induce the hole and corrupt the filesystem. Because normal write operations (including DIO writes) can activate the bug, an attacker does not need special conditions beyond the ability to write files on the volume. The damage would be confined to the filesystem and could lead to data loss or corruption but would not allow arbitrary code execution.