CVE-2026-89786 is a vulnerability in Linux Kernel
Published on September 16, 2026
ext4: fix out-of-bounds read in ext4_read_inline_dir()
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry
Read of size 2 at addr ffff88800f3dd23c by task exploit/148
...
__ext4_check_dir_entry
ext4_read_inline_dir
iterate_dir
The dirent payload lives in a buffer of exactly inline_size bytes:
dir_buf = kmalloc(inline_size, GFP_NOFS);
but iteration runs in a position space extra_offset bytes larger
(extra_size = extra_offset + inline_size) so the synthetic "." and ".."
land at their block-dir offsets. A dirent is formed at "dir_buf + pos -
extra_offset", yet the ext4_check_dir_entry() length argument uses the
larger extra_size. A position whose dirent header would extend past
extra_size is therefore accepted, and the rescan loop's rec_len probe and
ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.
Reject a position whose minimum-size dirent header would not fit within
extra_size before forming de, in both the rescan and main loops, and pass
inline_size rather than extra_size to ext4_check_dir_entry() so the length
check matches the physical buffer.
Products Associated with CVE-2026-89786
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below d1e7c186555ad65554fd2f2b02f5a539aa35ae48 is affected.
- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below 5fd20d4e50dd6e460b3ea8e4396f8553d4526f8f is affected.
- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below 1a1dea633b724a1c042dbcdb1fed27f410916688 is affected.
- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below b060861f662d4826dc700a1c3584243bb3474cfe is affected.
- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below 6702c7da86d8cdb88d0fc57166286e115ffeb8c0 is affected.
- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below 36bf17bb90cdf7a623499b624b05acde4d2feef5 is affected.
- Version c4d8b0235aa98f8c26bf94d308be3fdd24154572 and below 9333cc809f0a89e001b814155a6cb8903a6274df is affected.
- Version 3.10 is affected.
- Before 3.10 is unaffected.
- Version 5.15.221, <= 5.15.* is unaffected.
- Version 6.1.188, <= 6.1.* is unaffected.
- Version 6.6.157, <= 6.6.* is unaffected.
- Version 6.12.110, <= 6.12.* is unaffected.
- Version 6.18.52, <= 6.18.* is unaffected.
- Version 7.2.6, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.