CVE-2026-92499: ext4: validate readdir offset before accessing dirent
In the Linux kernel, the following vulnerability has been resolved:
ext4: validate readdir offset before accessing dirent
A corrupted directory can trigger the following KASAN report when ext4readdir() resumes from an invalid position:
BUG: KASAN: use-after-free in ext4checkdirentry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task reprolinear/509
Call Trace: <TASK> dumpstacklvl+0x53/0x70 printreport+0xd0/0x630 kasanreport+0xce/0x100 ext4checkdirentry+0x5ef/0x820 ext4readdir+0xcde/0x2b70 iteratedir+0x1a1/0x520 x64sysgetdents64+0x12b/0x220 dosyscall64+0xf9/0x540 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced.
ext4dirllseek() invalidates the directory cookie so that ext4readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of reclen before advancing. A corrupted reclen can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to ext4checkdirentry(). The latter reads de->reclen before validating the range. For example:
block offset 0 4092 4096 |---- de1.reclen = 4092 -----|----| de2.inode | de2.reclen ^ OOB, reported as UAF
de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its reclen starts at offset 4096 and crosses the boundary.
The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes.
Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure ext4 validates readdir offsets before accessing directory entries (referenced as fix: "ext4: validate readdir offset before accessing dirent").
Linux kernel ext4 validate readdir offset before accessing dirent = enabled
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An ext4 directory must be corrupted so that a directory entry has a malformed rec_len value. The problem occurs when ext4_readdir() resumes from an invalid position and rescans entries, potentially reaching an offset that lacks enough remaining block space for a complete directory entry.
Which operations are involved in reaching the vulnerable path?
The reported path involves ext4_dir_llseek() invalidating a directory cookie, followed by ext4_readdir() rescanning the directory. The call trace shows this can occur through iterate_dir() and the getdents64 system call.
How can an affected system be recognized?
A KASAN-enabled kernel may report a use-after-free in __ext4_check_dir_entry during ext4_readdir(). The report can result from an out-of-bounds directory-entry access landing in an adjacent freed page, even though the directory buffer remains referenced.