{"id":"CVE-2026-89786","revision":"170f9c60c7a14b0fbf3c7136f084b362","records":[{"revision":"170f9c60c7a14b0fbf3c7136f084b362","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89786","aliases":[],"title":"ext4: fix out-of-bounds read in ext4_read_inline_dir()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bounds read in ext4_read_inline_dir()\n\next4_read_inline_dir() can read a dirent header past the end of its inline\nbuffer, triggering a slab-out-of-bounds read during getdents64():\n\n BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry\n Read of size 2 at addr ffff88800f3dd23c by task exploit/148\n ...\n __ext4_check_dir_entry\n ext4_read_inline_dir\n iterate_dir\n\nThe dirent payload lives in a buffer of exactly inline_size bytes:\n\n\tdir_buf = kmalloc(inline_size, GFP_NOFS);\n\nbut iteration runs in a position space extra_offset bytes larger\n(extra_size = extra_offset + inline_size) so the synthetic \".\" and \"..\"\nland at their block-dir offsets. A dirent is formed at \"dir_buf + pos -\nextra_offset\", yet the ext4_check_dir_entry() length argument uses the\nlarger extra_size. A position whose dirent header would extend past\nextra_size is therefore accepted, and the rescan loop's rec_len probe and\next4_check_dir_entry() dereference de->rec_len before the entry is rejected.\n\nReject a position whose minimum-size dirent header would not fit within\nextra_size before forming de, in both the rescan and main loops, and pass\ninline_size rather than extra_size to ext4_check_dir_entry() so the length\ncheck matches the physical buffer.","state":0,"publishedAt":"2026-09-16T08:48:23.73+00:00","modifiedAt":"2026-10-19T08:52:39.655+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/ext4/inline.c\"\n ],\n \"versions\": [\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"d1e7c186555ad65554fd2f2b02f5a539aa35ae48\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"5fd20d4e50dd6e460b3ea8e4396f8553d4526f8f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"1a1dea633b724a1c042dbcdb1fed27f410916688\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"b060861f662d4826dc700a1c3584243bb3474cfe\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"6702c7da86d8cdb88d0fc57166286e115ffeb8c0\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"36bf17bb90cdf7a623499b624b05acde4d2feef5\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c4d8b0235aa98f8c26bf94d308be3fdd24154572\",\n \"lessThan\": \"9333cc809f0a89e001b814155a6cb8903a6274df\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/ext4/inline.c\"\n ],\n \"versions\": [\n {\n \"version\": \"3.10\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"3.10\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.221\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.188\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.157\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.110\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.52\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.6\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":9.1,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/d1e7c186555ad65554fd2f2b02f5a539aa35ae48","https://git.kernel.org/stable/c/5fd20d4e50dd6e460b3ea8e4396f8553d4526f8f","https://git.kernel.org/stable/c/1a1dea633b724a1c042dbcdb1fed27f410916688","https://git.kernel.org/stable/c/b060861f662d4826dc700a1c3584243bb3474cfe","https://git.kernel.org/stable/c/6702c7da86d8cdb88d0fc57166286e115ffeb8c0","https://git.kernel.org/stable/c/36bf17bb90cdf7a623499b624b05acde4d2feef5","https://git.kernel.org/stable/c/9333cc809f0a89e001b814155a6cb8903a6274df"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89786","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89786","identifiers":["CVE-2026-89786"]},"retained":false,"historicalAffected":[]}],"coverage":[]}