UBUNTU-CVE-2026-89720: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature() bounds the on-disk ubifssignode->len field before handing the signature payload to verifypkcs7signature(), but the check has the wrong sign: if (le32tocpu(signode->len) > snod->len + sizeof(struct ubifssignode)) The signature bytes start sizeof(struct ubifssignode) (UBIFSSIGNODESZ, 64 bytes) into the node, so the payload is at most snod->len - sizeof(struct ubifssignode) bytes long. Adding the header size instead of subtracting it accepts a declared length up to 2 UBIFSSIGNODESZ larger than the node actually holds -- past the end of c->sbuf, which is vmalloc(c->lebsize). verifypkcs7signature() -> pkcs7parsemessage() -> asn1berdecoder() is then handed that inflated length and reads beyond the allocation while walking the DER headers. The node length comes straight from the mounted image, so a crafted signed UBIFS image reaches this via ubifsreadsuperblock() before the signature is cryptographically checked. snod->len is guaranteed to be >= UBIFSSIGNODESZ by the node scanner (c->ranges[UBIFSSIGNODE].minlen == UBIFSSIGNODESZ), so the corrected subtraction cannot underflow. Legitimately signed images are unaffected: a correct superblock never declares a signature longer than the node it is embedded in.