Executive brief
The Linux kernel's UBIFS filesystem implementation contains a bounds-checking error in signature validation that allows reading beyond allocated memory. An attacker can mount a specially crafted UBIFS image to trigger out-of-bounds reads in the kernel's memory, potentially leading to information disclosure or system crash. This affects systems that mount untrusted UBIFS filesystems.
Technical details
The vulnerability is a bounds-checking logic error in ubifs_sb_verify_signature() in fs/ubifs/auth.c. The function incorrectly validates the length field of a signature node by adding (instead of subtracting) the header size, allowing an attacker to declare a signature length up to 2× UBIFS_SIG_NODE_SZ (128 bytes) beyond the actual node size. This inflated length is then passed to verify_pkcs7_signature() → pkcs7_parse_message() → asn1_ber_decoder(), which reads beyond the c->sbuf allocation while parsing DER headers. The vulnerability is triggered via ubifs_read_superblock() before cryptographic validation, so a crafted image with a malicious signature node reaches this code path. The fix changes the comparison operator from addition to subtraction. Legitimate signed images are unaffected because valid superblocks never declare signatures longer than their nodes.
Affected products
- Linux Linux kernel multiple versions with ubifs support (at least from linux-4.x through linux-7.x based on patch distribution)
Timeline
- 2026-09-11: disclosed: Advisory published on NVD
- 2026-07-24: patched: Fix committed upstream (commit 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf)
- 2026-09-14: patched: Backported to stable kernel branches