Executive brief
A vulnerability was identified in the Linux kernel's ext4 file system driver that could lead to an out-of-bounds memory access. The ext4 file system is a standard component used to manage data storage on many Linux-based servers and devices. If exploited, this flaw could potentially cause a system crash or allow unauthorized access to sensitive kernel memory, impacting the stability and security of the operating system.
Technical details
An out-of-bounds read vulnerability existed in the ext4 file system's check_xattrs() function due to an insufficient bounds check. The original check used '(void *)next >= end', which failed to account for the 4-byte read performed by the IS_LAST_ENTRY() macro in the subsequent loop iteration. If the 'next' pointer landed within 3 bytes of the 'end' boundary, the macro would read beyond the valid xattr region. This could be triggered by a specially crafted or corrupted ext4 filesystem image. The issue has been resolved by updating the bounds check to ensure at least 4 bytes (sizeof(u32)) remain before the end of the buffer. Patches have been backported to various stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-05-27: disclosed: CVE published by NVD
- 2026-05-27: patched: Fixes merged into multiple stable kernel branches
References
- https://git.kernel.org/stable/c/520986722dbf869c122252123fc161c7302eab7d
- https://git.kernel.org/stable/c/537e065977022aa22f2c2503e8accaf16622e0fd
- https://git.kernel.org/stable/c/5a5314d2387633a272a04d1bd8727f99058e4e68
- https://git.kernel.org/stable/c/ab6da97bc310db35d4e4ef5354bc3ff626b0698c
- https://git.kernel.org/stable/c/eceafc31ea7b42c984ece10d79d505c0bb6615d5