CVE-2026-89787: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
ext4: check dir entry fits before reading the hash trailer in ext4searchdir()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using ext4 casefolded encrypted directories are exposed on the sb_no_casefold_compat_fallback() lookup path. The malformed directory entry must place its name at the directory-block boundary so that the hash trailer extends beyond the block.
What action triggers the out-of-bounds read?
An ordinary lookup of the crafted directory entry triggers ext4_search_dir() and can reach the out-of-bounds hash-trailer read in ext4_match(). The reported call path includes filename lookup and statx operations.
How could administrators identify a possible occurrence?
KASAN may report a use-after-free in ext4_match, with a read of size 4 and call frames including ext4_search_dir(), __ext4_find_entry(), and ext4_lookup(). The underlying condition is an out-of-bounds read past a directory block, even though the report may be classified as use-after-free depending on adjacent page contents.