Executive brief
The Linux kernel's ext4 filesystem contains a vulnerability in its directory reading functionality that can trigger memory safety errors when processing corrupted directory structures. An attacker with ability to create or modify a corrupted filesystem could cause the kernel to read memory beyond allocated boundaries, potentially leading to information disclosure or system instability.
Technical details
The vulnerability is a use-after-free/out-of-bounds read in the ext4_readdir() function when handling corrupted directory entries with invalid record lengths (rec_len). When ext4_dir_llseek() invalidates the directory cookie and ext4_readdir() rescans from an invalid position, the code may dereference a truncated directory entry that spans beyond the 4 KiB block boundary. The __ext4_check_dir_entry() function reads the rec_len field before validating that the entry fits entirely within the block, allowing out-of-bounds reads. The fix involves caching metadata checksum state and validating the minimum safe directory entry length before accessing any entry fields, bounding both the rescan operation and offsets passed to the main loop.
Affected products
- Linux Linux kernel multiple versions with ext4 filesystem support
Timeline
- 2026-09-17: patched