{"id":"CVE-2026-89787","revision":"ae62ee8a11314928ae55b7c6d688720c","records":[{"revision":"ae62ee8a11314928ae55b7c6d688720c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89787","aliases":[],"title":"ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: check dir entry fits before reading the hash trailer in ext4_search_dir()\n\nFor casefolded encrypted directories ext4 stores an 8-byte hash trailer\nafter the name (EXT4_DIRENT_HASHES()), at an offset derived from\nde->name_len. On the sb_no_casefold_compat_fallback() path ext4_match()\nreads that trailer, but ext4_search_dir()'s by-hand pre-check only tests\nde->name + de->name_len <= dlimit, which proves the name fits, not the\nrounded trailer. A crafted entry whose name ends at the block boundary\npasses the check while EXT4_DIRENT_HASHES(de) lands past the block end,\nso ext4_match() reads out of bounds on an ordinary lookup. KASAN reports\nit as a use-after-free when the page after the directory block holds a\nfreed object:\n\n BUG: KASAN: use-after-free in ext4_match (fs/ext4/namei.c:1435)\n Read of size 4 at addr ffff888010458000 by task exploit\n Call Trace:\n ext4_match (fs/ext4/namei.c:1435)\n ext4_search_dir (fs/ext4/namei.c:1470)\n __ext4_find_entry (fs/ext4/namei.c:1268 fs/ext4/namei.c:1632)\n ext4_lookup (fs/ext4/namei.c:1703 fs/ext4/namei.c:1769)\n ...\n filename_lookup (fs/namei.c:2842)\n vfs_statx (fs/stat.c:353)\n __do_sys_newfstatat (fs/stat.c:538)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nRequire, for hash-in-dirent directories, that the whole entry including\nthe rounded trailer fits before calling ext4_match(). This is the same\nbound ext4_check_dir_entry() already enforces via ext4_dir_rec_len(), so\nno well-formed entry is rejected. The other caller, ext4_find_dest_de(),\nruns ext4_check_dir_entry() first and is unaffected.","state":0,"publishedAt":"2026-09-16T08:48:24.403+00:00","modifiedAt":"2026-10-19T08:52:40.961+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/ext4/namei.c\"\n ],\n \"versions\": [\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"4d20106c536b73c4a8a02652dc85e35898baebf7\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"61a395967de06edba58760e81907a272db749faa\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"e94676a08af6312aa72d8a981232b281f9bcfcf5\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"d8c184bec24b5a00ae96d704856d935eaded1685\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"3933884bc3102898b458c53fbd1ac52eb9cdb8a4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"83663c0b739480c00cfe785675db87520ec484ed\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"471fbbea7ff7061b2d6474665cb5a2ceb4fd6500\",\n \"lessThan\": \"c7e6b863d298f56522d0d08554bbea7f142e6588\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/ext4/namei.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.13\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.13\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.221\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.188\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.157\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.110\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.52\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.6\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/4d20106c536b73c4a8a02652dc85e35898baebf7","https://git.kernel.org/stable/c/61a395967de06edba58760e81907a272db749faa","https://git.kernel.org/stable/c/e94676a08af6312aa72d8a981232b281f9bcfcf5","https://git.kernel.org/stable/c/d8c184bec24b5a00ae96d704856d935eaded1685","https://git.kernel.org/stable/c/3933884bc3102898b458c53fbd1ac52eb9cdb8a4","https://git.kernel.org/stable/c/83663c0b739480c00cfe785675db87520ec484ed","https://git.kernel.org/stable/c/c7e6b863d298f56522d0d08554bbea7f142e6588"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89787","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89787","identifiers":["CVE-2026-89787"]},"retained":false,"historicalAffected":[]}],"coverage":[]}