CVE-2026-89786

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix out-of-bounds read in ext4_read_inline_dir()

ext4_read_inline_dir() can read a dirent header past the end of its inline

buffer, triggering a slab-out-of-bounds read during getdents64():

BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry

Read of size 2 at addr ffff88800f3dd23c by task exploit/148

...

__ext4_check_dir_entry

ext4_read_inline_dir

iterate_dir

The dirent payload lives in a buffer of exactly inline_size bytes:

dir_buf = kmalloc(inline_size, GFP_NOFS);

but iteration runs in a position space extra_offset bytes larger

(extra_size = extra_offset + inline_size) so the synthetic "." and ".."

land at their block-dir offsets. A dirent is formed at "dir_buf + pos -

extra_offset", yet the ext4_check_dir_entry() length argument uses the

larger extra_size. A position whose dirent header would extend past

extra_size is therefore accepted, and the rescan loop's rec_len probe and

ext4_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References