Executive brief
The ext4 filesystem implementation in the Linux kernel contains a buffer overread vulnerability in the code that reads directory listings from inline data structures. An attacker with local access could trigger this flaw during directory enumeration (getdents64 syscall), potentially leaking sensitive kernel memory or crashing the system. This affects any system using ext4 filesystems with inline directory support.
Technical details
The vulnerability is a slab-out-of-bounds read (CWE-125) in the ext4_read_inline_dir() function. The root cause is a mismatch between the buffer size (inline_size) where directory entries are stored and the position space (extra_size = extra_offset + inline_size) used during iteration. The code constructs a directory entry pointer at "dir_buf + pos - extra_offset" but validates it against the larger extra_size boundary. This allows a directory position whose entry header would extend past the actual buffer to be accepted, causing ext4_check_dir_entry() and rec_len dereference to read 2 bytes past the allocated buffer. The attack requires local filesystem access via getdents64() with a crafted inline directory structure. A patch was issued that validates buffer bounds before forming the directory entry pointer and corrects the length check to use inline_size instead of extra_size.
Affected products
- Linux Linux kernel all versions with ext4 inline directory support
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-14: patched: Patch committed to stable kernel trees
- 2026-06-15: other: Original fix committed upstream