CVE-2026-46094 Overview
CVE-2026-46094 is an out-of-bounds read vulnerability in the Linux kernel's ext4 filesystem. The flaw exists in the check_xattrs() function, where the bounds check for the next extended attribute (xattr) entry uses (void *)next >= end. This check allows next to point within sizeof(u32) bytes of end, causing IS_LAST_ENTRY() to read 4 bytes beyond the valid xattr region on the subsequent loop iteration. Triggering the condition requires parsing a crafted xattr block during filesystem operations.
Critical Impact
Processing a malformed ext4 extended attribute block can cause the kernel to read up to 3 bytes outside the valid xattr region, potentially leading to information disclosure or kernel instability.
Affected Products
- Linux kernel (ext4 filesystem subsystem)
- Distributions shipping vulnerable kernel versions prior to the upstream fix
- Systems mounting untrusted ext4 filesystems
Discovery Timeline
- 2026-05-27 - CVE-2026-46094 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46094
Vulnerability Analysis
The vulnerability resides in the check_xattrs() validation routine within the ext4 filesystem code. When iterating through extended attribute entries, the function validates that the next pointer does not exceed the end of the xattr region. The original check (void *)next >= end permits next to land anywhere from end - 1 through end - 3, leaving fewer than 4 bytes of valid space before the boundary.
On the following iteration, the loop invokes IS_LAST_ENTRY(), which dereferences *(__u32 *)(entry) to read a 32-bit value. When next was positioned within sizeof(u32) bytes of end, this read accesses memory beyond the valid xattr region. The result is an out-of-bounds read of 1 to 3 bytes [CWE-125].
Root Cause
The root cause is an off-by-less-than-four boundary check. The validation logic only ensured the entry pointer itself was within bounds, not that there was sufficient remaining space to perform the next 4-byte read. Without accounting for the size of the upcoming dereference, the validation permits subsequent reads to overrun the buffer.
Attack Vector
An attacker capable of supplying a crafted ext4 image or modifying xattr blocks on a mounted filesystem can position the final xattr entry so that next falls within 3 bytes of the region end. When the kernel parses the malformed structure, the out-of-bounds read occurs in kernel address space. Exploitation typically requires the ability to mount an attacker-controlled filesystem, a scenario common with removable media and certain container or virtualization workflows.
The upstream fix changes the bounds check to (void *)next + sizeof(u32) > end, guaranteeing sufficient space for the IS_LAST_ENTRY() read on the next iteration. Technical details are available in the Kernel Patch Commit 5209867 and Kernel Patch Commit eceafc3.
Detection Methods for CVE-2026-46094
Indicators of Compromise
- Unexpected kernel log entries referencing ext4 xattr validation errors or check_xattrs warnings
- KASAN reports flagging out-of-bounds reads within fs/ext4/xattr.c on instrumented kernels
- Mount operations on user-supplied ext4 images followed by kernel instability
Detection Strategies
- Audit kernel versions across endpoints and servers to identify hosts running ext4 code predating the fix commits
- Monitor dmesg and journal logs for ext4 corruption warnings tied to extended attribute parsing
- Inspect mount events for ext4 filesystems originating from removable media or untrusted sources
Monitoring Recommendations
- Enable kernel audit rules for mount syscalls involving ext4 filesystems from non-root sources
- Forward kernel messages to a centralized logging or SIEM platform for correlation with mount activity
- Track package update status for kernel components on Linux fleets to confirm patch deployment
How to Mitigate CVE-2026-46094
Immediate Actions Required
- Apply vendor-supplied kernel updates that incorporate the upstream fix to check_xattrs()
- Restrict the ability of unprivileged users to mount arbitrary ext4 filesystems
- Disable automount for removable media on systems handling untrusted devices
Patch Information
The issue is resolved across multiple stable branches. Reference the upstream commits: Kernel Patch Commit 5209867, Kernel Patch Commit 537e065, Kernel Patch Commit 5a5314d, Kernel Patch Commit ab6da97, and Kernel Patch Commit eceafc3. Distribution maintainers should backport these patches to supported kernel trees.
Workarounds
- Avoid mounting ext4 filesystems from untrusted sources until patches are deployed
- Apply udev rules or polkit policies to block automatic mounting of external ext4 media
- Use container and virtualization configurations that prevent guests from passing raw ext4 images to the host kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
