CVE-2026-89786 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry Read of size 2 at addr ffff88800f3dd23c by task exploit/148 ... __ext4_check_dir_entry ext4_read_inline_dir iterate_dir
The dirent payload lives in a buffer of exactly inline_size bytes:
dir_buf = kmalloc(inline_size, GFP_NOFS);
but iteration runs in a position space extra_offset bytes larger (extra_size = extra_offset + inline_size) so the synthetic "." and ".." land at their block-dir offsets. A dirent is formed at "dir_buf + pos - extra_offset", yet the ext4_check_dir_entry() length argument uses the larger extra_size. A position whose dirent header would extend past extra_size is therefore accepted, and the rescan loop's rec_len probe and ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.
Reject a position whose minimum-size dirent header would not fit within extra_size before forming de, in both the rescan and main loops, and pass inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches the physical buffer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's ext4 filesystem driver contains a critical out-of-bounds read vulnerability within the ext4_read_inline_dir function, which is invoked during directory listing operations such as getdents64. This flaw arises from an inconsistency in how buffer boundaries are calculated and validated when handling inline directories. Inline directories store file entries directly within the inode data block rather than using separate disk blocks to optimize performance for small directories. However, the current implementation incorrectly manages the boundary checks during iteration over these directory entries, leading to memory safety violations that can be exploited by local attackers or potentially triggered through crafted filesystem images.
The technical root cause lies in a mismatch between the allocated buffer size and the validation logic used to check directory entry headers. The kernel allocates a buffer of exactly inline_size bytes to hold the dirent payload for an inline directory. However, during iteration, the code operates within a position space that is larger by extra_offset bytes, resulting in a calculated total size referred to as extra_size. When forming a directory entry pointer at dir_buf plus pos minus extra_offset, the validation function ext4_check_dir_entry incorrectly uses this inflated extra_size for length checks instead of the actual physical buffer limit of inline_size. Consequently, if a dirent header is positioned such that it extends beyond the allocated inline_size boundary but remains within the larger extra_size range, the kernel accepts it as valid and proceeds to dereference fields like rec_len before rejecting the entry. This results in a slab-out-of-bounds read where the kernel accesses memory outside the intended allocation scope.
From an operational impact perspective, this vulnerability allows for unauthorized information disclosure through kernel memory leakage. An attacker who can trigger directory reads on affected inline directories may be able to read arbitrary kernel stack or heap data adjacent to the allocated buffer. While primarily classified as a read-only violation in this instance, such out-of-bounds accesses often serve as precursors to more severe exploits if combined with other vulnerabilities or specific memory layouts that allow for controlled overwrites. The vulnerability is particularly dangerous because it can be triggered by standard system calls like getdents64, meaning any user process capable of listing directories on a maliciously crafted filesystem image could exploit this flaw without requiring elevated privileges initially, although privilege escalation would likely require further exploitation steps to achieve arbitrary code execution or kernel persistence.
This vulnerability maps directly to CWE-125, which describes out-of-bounds read vulnerabilities where software reads data past the end of a buffer. In terms of offensive security frameworks, it aligns with ATT&CK technique T1083, specifically file and directory discovery, as the exploitation vector involves reading directory contents. The flaw represents a classic boundary condition error common in low-level systems programming where logical offsets are not strictly bounded by physical allocation limits.
To mitigate this vulnerability, system administrators should apply the latest kernel updates provided by their distribution vendors that include the patch for ext4_read_inline_dir. The fix ensures that position checks reject any dirent header that would extend past extra_size before forming the directory entry structure and correctly passes inline_size to ext4_check_dir_entry so length validations match the actual physical buffer constraints. Until patches are applied, limiting access to untrusted filesystem images or restricting who can perform directory listing operations on sensitive mounts may reduce exposure risk. Developers reviewing similar code paths should enforce strict alignment between logical iteration bounds and physical memory allocation sizes to prevent analogous boundary check bypasses in other subsystems.