Executive brief
The Linux ext4 filesystem has a bug in how it validates directory entries with encrypted and case-insensitive file names. When looking up a file, the kernel reads a metadata trailer associated with the file name without properly checking that it fits within the directory block boundaries. An attacker with the ability to craft a malicious directory entry could trigger an out-of-bounds memory read, potentially exposing kernel memory or causing a denial of service.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the ext4 filesystem's directory entry lookup code (ext4_search_dir). For casefolded encrypted directories, ext4 stores an 8-byte hash trailer after the entry name; the code checks only that the name fits within the directory block boundary (de->name + de->name_len <= dlimit) but does not account for the trailing hash metadata, which may be rounded up and extend past the block end. When ext4_match() attempts to read this trailer, it accesses memory outside the allocated directory block. The attack requires the ability to craft a malicious directory entry where the name ends exactly at the block boundary. This is a local attack requiring filesystem access; the impact is an out-of-bounds read reported by KASAN as a use-after-free when the subsequent page holds freed memory, leading to information disclosure or denial of service.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-16: disclosed