CVE-2026-45920

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45920", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.085Z", "datePublished": "2026-05-27T12:17:38.234Z", "dateUpdated": "2026-11-06T15:53:13.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-27T12:17:38.234Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar->len out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/mballoc-test.c", "fs/ext4/mballoc.c"], "versions": [{"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "523d5a4df3c649fa305c89efb552ec62a1ce9d3d", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "ca408af08544d96769c93a3d81a7f63f61129e95", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "55576fa14771d33994c29a9ae960e07bb3f56c20", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "dbc4e10619ed87a50e637b96f2e574df36a7a769", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "61e372122b6d95aec940fdaea0a16f988f359897", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "3924aea2c33df3864929c1acd178bfc29d8f005f", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "81982a11406c5da6c6e2b188028e7056e16b7128", "status": "affected", "versionType": "git"}, {"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "94a8cea54cd935c54fa2fba70354757c0fc245e3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/mballoc-test.c", "fs/ext4/mballoc.c"], "versions": [{"version": "2.6.29", "status": "affected"}, {"version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.18.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d"}, {"url": "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95"}, {"url": "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20"}, {"url": "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769"}, {"url": "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897"}, {"url": "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f"}, {"url": "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128"}, {"url": "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3"}], "title": "ext4: fix dirtyclusters double decrement on fs shutdown", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:44:36.783306Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:53:13.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:44:36.783306Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:44:37.904Z"}}], "cna": {"title": "ext4: fix dirtyclusters double decrement on fs shutdown", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "523d5a4df3c649fa305c89efb552ec62a1ce9d3d", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "ca408af08544d96769c93a3d81a7f63f61129e95", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "55576fa14771d33994c29a9ae960e07bb3f56c20", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "dbc4e10619ed87a50e637b96f2e574df36a7a769", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "61e372122b6d95aec940fdaea0a16f988f359897", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "3924aea2c33df3864929c1acd178bfc29d8f005f", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "81982a11406c5da6c6e2b188028e7056e16b7128", "versionType": "git"}, {"status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "lessThan": "94a8cea54cd935c54fa2fba70354757c0fc245e3", "versionType": "git"}], "programFiles": ["fs/ext4/mballoc-test.c", "fs/ext4/mballoc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.29", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.14", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.4", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ext4/mballoc-test.c", "fs/ext4/mballoc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d"}, {"url": "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95"}, {"url": "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20"}, {"url": "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769"}, {"url": "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897"}, {"url": "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f"}, {"url": "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128"}, {"url": "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar->len out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.75", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.14", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.4", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "2.6.29"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-27T12:17:38.234Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45920", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:53:13.103Z", "dateReserved": "2026-05-13T15:03:33.085Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-27T12:17:38.234Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ext4/mballoc-test.c", "fs/ext4/mballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "523d5a4df3c649fa305c89efb552ec62a1ce9d3d", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "ca408af08544d96769c93a3d81a7f63f61129e95", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "55576fa14771d33994c29a9ae960e07bb3f56c20", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "dbc4e10619ed87a50e637b96f2e574df36a7a769", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "61e372122b6d95aec940fdaea0a16f988f359897", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "3924aea2c33df3864929c1acd178bfc29d8f005f", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "81982a11406c5da6c6e2b188028e7056e16b7128", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}, {"lessThan": "94a8cea54cd935c54fa2fba70354757c0fc245e3", "status": "affected", "version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ext4/mballoc-test.c", "fs/ext4/mballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"lessThan": "2.6.29", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.14", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C1B1C38-DBED-4FC4-AE7D-B0A2622E224F", "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF463CB7-1F58-4607-B847-77ED23E4B9B7", "versionEndExcluding": "6.18.14", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar->len out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure."}], "id": "CVE-2026-45920", "lastModified": "2026-11-06T16:18:52.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45920", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:44:36.783306Z", "version": "2.0.3"}}]}, "published": "2026-05-27T14:17:06.930", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ext4: fix dirtyclusters double decrement on fs shutdown", "id": "2481967", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481967"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows a local user to trigger an inconsistency in the dirty clusters count during filesystem shutdown. The issue stems from a double decrement in the error handling path, which can lead to system instability and a denial of service."], "name": "CVE-2026-45920", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-45920\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45920\nhttps://lore.kernel.org/linux-cve-announce/2026052724-CVE-2026-45920-db68@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,523d5a4df3c649fa305c89efb552ec62a1ce9d3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,ca408af08544d96769c93a3d81a7f63f61129e95)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,55576fa14771d33994c29a9ae960e07bb3f56c20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,dbc4e10619ed87a50e637b96f2e574df36a7a769)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,61e372122b6d95aec940fdaea0a16f988f359897)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,3924aea2c33df3864929c1acd178bfc29d8f005f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,81982a11406c5da6c6e2b188028e7056e16b7128)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0087d9fb3f29f59e8d42c8b058376d80e5adde4c,94a8cea54cd935c54fa2fba70354757c0fc245e3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.29"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.29)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.14,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-27T17:45:33.034071+00:00", "updated": "2026-08-12T03:00:11.129358+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}