CVE-2026-89787

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

For casefolded encrypted directories ext4 stores an 8-byte hash trailer

after the name (EXT4_DIRENT_HASHES()), at an offset derived from

de->name_len. On the sb_no_casefold_compat_fallback() path ext4_match()

reads that trailer, but ext4_search_dir()'s by-hand pre-check only tests

de->name + de->name_len <= dlimit, which proves the name fits, not the

rounded trailer. A crafted entry whose name ends at the block boundary

passes the check while EXT4_DIRENT_HASHES(de) lands past the block end,

so ext4_match() reads out of bounds on an ordinary lookup. KASAN reports

it as a use-after-free when the page after the directory block holds a

freed object:

BUG: KASAN: use-after-free in ext4_match (fs/ext4/namei.c:1435)

Read of size 4 at addr ffff888010458000 by task exploit

Call Trace:

ext4_match (fs/ext4/namei.c:1435)

ext4_search_di

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References