CVE-2026-92499 - Vulnerability Details

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

Link	Providers
https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161
https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e
https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 \|---- de1.rec_len = 4092 -----\|----\| de2.inode \| de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary.
Title		ext4: validate readdir offset before accessing dirent
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161 https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92499", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-16T12:21:13.871Z", "datePublished": "2026-09-17T16:10:13.391Z", "dateUpdated": "2026-09-17T16:10:13.391Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-17T16:10:13.391Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate readdir offset before accessing dirent\n\nA corrupted directory can trigger the following KASAN report when\next4_readdir() resumes from an invalid position:\n\n BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820\n Read of size 2 at addr ffff88810a646000 by task repro_linear/509\n\n Call Trace:\n <TASK>\n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n kasan_report+0xce/0x100\n __ext4_check_dir_entry+0x5ef/0x820\n ext4_readdir+0xcde/0x2b70\n iterate_dir+0x1a1/0x520\n __x64_sys_getdents64+0x12b/0x220\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nKASAN reports use-after-free because the out-of-bounds access lands in an\nadjacent freed page. The directory buffer itself is still referenced.\n\next4_dir_llseek() invalidates the directory cookie so that ext4_readdir()\nrescans directory entries from the start of the block. The rescan checks\nonly the lower bound of rec_len before advancing. A corrupted rec_len can\ntherefore place the offset where the block has insufficient space for a\ncomplete directory entry. The rescan itself may dereference that truncated\nentry, or the main loop may pass it to __ext4_check_dir_entry(). The latter\nreads de->rec_len before validating the range. For example:\n\n block offset 0 4092 4096\n |---- de1.rec_len = 4092 -----|----|\n de2.inode\n | de2.rec_len\n ^ OOB, reported as UAF\n\nde2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in\nthe block, but its rec_len starts at offset 4096 and crosses the boundary.\n\nThe minimum safe length is inode-dependent. Encrypted and casefolded\ndirectory entries need eight additional hash bytes, while a valid metadata\nchecksum tail is only 12 bytes.\n\nCache the metadata checksum feature state and derive the minimum directory\nentry length from the on-disk format. Use it to bound both the rescan and\nthe offset passed to the main loop. Report an offset in a truncated block\ntail and skip the remainder of the block, while continuing to accept an\noffset exactly at the block boundary."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/dir.c"], "versions": [{"version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "lessThan": "64d445d40e5ea4c4d4d88880db753b370cb69161", "status": "affected", "versionType": "git"}, {"version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "lessThan": "b4c728577933753180e3e97f08424d5bcaff705e", "status": "affected", "versionType": "git"}, {"version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "lessThan": "bc4b7b0414c33b2c8898eb04386df0d21a13dad8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/dir.c"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161"}, {"url": "https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e"}, {"url": "https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}], "title": "ext4: validate readdir offset before accessing dirent", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ext4/dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "64d445d40e5ea4c4d4d88880db753b370cb69161", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git"}, {"lessThan": "b4c728577933753180e3e97f08424d5bcaff705e", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git"}, {"lessThan": "bc4b7b0414c33b2c8898eb04386df0d21a13dad8", "status": "affected", "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ext4/dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate readdir offset before accessing dirent\n\nA corrupted directory can trigger the following KASAN report when\next4_readdir() resumes from an invalid position:\n\n BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820\n Read of size 2 at addr ffff88810a646000 by task repro_linear/509\n\n Call Trace:\n <TASK>\n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n kasan_report+0xce/0x100\n __ext4_check_dir_entry+0x5ef/0x820\n ext4_readdir+0xcde/0x2b70\n iterate_dir+0x1a1/0x520\n __x64_sys_getdents64+0x12b/0x220\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nKASAN reports use-after-free because the out-of-bounds access lands in an\nadjacent freed page. The directory buffer itself is still referenced.\n\next4_dir_llseek() invalidates the directory cookie so that ext4_readdir()\nrescans directory entries from the start of the block. The rescan checks\nonly the lower bound of rec_len before advancing. A corrupted rec_len can\ntherefore place the offset where the block has insufficient space for a\ncomplete directory entry. The rescan itself may dereference that truncated\nentry, or the main loop may pass it to __ext4_check_dir_entry(). The latter\nreads de->rec_len before validating the range. For example:\n\n block offset 0 4092 4096\n |---- de1.rec_len = 4092 -----|----|\n de2.inode\n | de2.rec_len\n ^ OOB, reported as UAF\n\nde2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in\nthe block, but its rec_len starts at offset 4096 and crosses the boundary.\n\nThe minimum safe length is inode-dependent. Encrypted and casefolded\ndirectory entries need eight additional hash bytes, while a valid metadata\nchecksum tail is only 12 bytes.\n\nCache the metadata checksum feature state and derive the minimum directory\nentry length from the on-disk format. Use it to bound both the rescan and\nthe offset passed to the main loop. Report an offset in a truncated block\ntail and skip the remainder of the block, while continuing to accept an\noffset exactly at the block boundary."}], "id": "CVE-2026-92499", "lastModified": "2026-09-17T17:17:52.280", "metrics": {}, "published": "2026-09-17T17:17:52.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

Metrics

Affected Vendors & Products

Projects

Metrics

Affected Vendors & Products

Projects

JSON object

JSON object

JSON object

JSON object

JSON object