{"id":"CVE-2026-31449","revision":"226e13c4d9ce4ef1b1cb6300c395118f","records":[{"revision":"226e13c4d9ce4ef1b1cb6300c395118f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31449","aliases":[],"title":"ext4: validate p_idx bounds in ext4_ext_correct_indexes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.","state":0,"publishedAt":"2026-04-22T13:53:44.777+00:00","modifiedAt":"2026-10-19T18:35:48.867+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ext4/extents.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"39d6e2b67651614bac0dc6592fa9836321910067\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"c5839b34704c9c2f47f079451bdbb22de0da1ed1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"10242e640b36b91ad03d25f3dc77854bbdff8358\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"4d08401aa13f1531216f1a7ae281ca4806e90a5c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"407c944f217c17d4343148011acafebc604d55e1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"93f2e975ed658ce09db4d4c2877ca2c06540df83\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"01bf1e0b997d82c0e353b51ed74ef99698043c33\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a86c61812637c7dd0c57e29880cffd477b62f2e7\",\n                            \"lessThan\": \"2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ext4/extents.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.259\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.140\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.80\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.21\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.11\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067","https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1","https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358","https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c","https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1","https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83","https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33","https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31449","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31449","identifiers":["CVE-2026-31449"]},"retained":false,"historicalAffected":[]}],"coverage":[]}