CVE-2026-89720

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ubifs: fix out-of-bounds read in signature length check

ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field

before handing the signature payload to verify_pkcs7_signature(), but the

check has the wrong sign:

if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))

The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,

64 bytes) into the node, so the payload is at most

snod->len - sizeof(struct ubifs_sig_node)

bytes long. Adding the header size instead of subtracting it accepts a

declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually

holds -- past the end of c->sbuf, which is vmalloc(c->leb_size).

verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()

is then handed that inflated length and reads beyond the allocation while

walking the DER headers. The node length comes straight from the mounted

image, so a crafted si

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References