CVE-2026-89720: Linux Kernel UBIFS Buffer Overflow Vulnerability

CVE-2026-89720 Overview

CVE-2026-89720 is an out-of-bounds read vulnerability in the Linux kernel's UBIFS filesystem signature verification routine. The flaw resides in ubifs_sb_verify_signature(), which incorrectly validates the on-disk ubifs_sig_node->len field before passing the signature payload to verify_pkcs7_signature(). A sign error in the bounds check allows a crafted UBIFS image to declare a signature length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds. The kernel then reads past the end of the c->sbuf allocation while decoding DER headers during PKCS#7 parsing.

Critical Impact
A crafted signed UBIFS image mounted on a vulnerable system triggers a kernel out-of-bounds read before any cryptographic verification occurs, potentially causing kernel information disclosure or system crash.

Affected Products

Linux kernel versions containing the flawed ubifs_sb_verify_signature() bounds check in fs/ubifs/
Distributions shipping affected kernels with UBIFS signature verification enabled
Embedded systems and IoT devices using UBIFS on raw flash storage

Discovery Timeline

2026-09-11 - CVE-2026-89720 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89720

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the UBIFS superblock signature verification path. When mounting a UBIFS volume, ubifs_read_superblock() invokes ubifs_sb_verify_signature() to validate the embedded PKCS#7 signature. The function performs a length sanity check on the attacker-controlled signode->len field before invoking verify_pkcs7_signature().

The defective check uses addition where subtraction is required. The signature payload begins sizeof(struct ubifs_sig_node) bytes (64 bytes, UBIFS_SIG_NODE_SZ) into the node, so the maximum legitimate payload length is snod->len - sizeof(struct ubifs_sig_node). Instead, the original code compared against snod->len + sizeof(struct ubifs_sig_node), allowing a declared length up to 128 bytes beyond the node boundary. The inflated length is forwarded to pkcs7_parse_message() and then asn1_ber_decoder(), which walks DER headers past the end of the vmalloc(c->leb_size) buffer.

Root Cause

The root cause is an inverted arithmetic sign in a boundary validation check. The comparison le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node) fails to reject payload lengths that exceed the actual node contents. Because snod->len is guaranteed to be at least UBIFS_SIG_NODE_SZ by the node scanner ranges table, the corrected subtraction cannot underflow.

Attack Vector

Exploitation requires local access with the ability to supply or mount a crafted UBIFS image. The malicious length field is embedded in the superblock and is parsed before any cryptographic verification, meaning signature checking provides no defense. Systems that automatically mount removable flash media or accept firmware update images in UBIFS format are the primary exposure surface. Successful exploitation triggers a kernel read past the c->sbuf allocation, which can leak adjacent kernel memory or crash the system.

No verified public exploit code is available. Refer to the upstream commits linked below for the corrected bounds check.

Detection Methods for CVE-2026-89720

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ubifs_sb_verify_signature, pkcs7_parse_message, or asn1_ber_decoder in dmesg
Mount attempts against untrusted UBIFS images from removable media or firmware update payloads
KASAN reports flagging out-of-bounds reads inside the c->sbuf vmalloc region during UBIFS mount

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to catch out-of-bounds reads triggered by malformed UBIFS superblocks
Audit kernel package versions against the fix commits 11abc34, 37a9d25, 83e1aa9, 8cc3da7, 95d27c1, a1dc246, ab7405b, and f76b79d from the mainline and stable trees
Monitor auditd and syslog for mount -t ubifs invocations originating from non-administrative sources

Monitoring Recommendations

Correlate filesystem mount events with subsequent kernel warnings on endpoints running Linux kernels with UBIFS enabled
Track deployment status of stable kernel updates across embedded and IoT fleets where UBIFS is common
Alert on repeated mount failures involving UBIFS volumes, which may indicate probing with malformed images

How to Mitigate CVE-2026-89720

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable commits 11abc34698cb, 37a9d25a563f, 83e1aa9f5f90, 8cc3da72cf57, 95d27c1708bb, a1dc246f98bb, ab7405bd8633, and f76b79d6e42a
Restrict UBIFS mount privileges to trusted administrators and disable automatic mounting of removable flash media
Validate firmware update pipelines to ensure only signed, vendor-supplied UBIFS images are accepted

Patch Information

The fix replaces the addition with a subtraction in the bounds check so that the declared signature length cannot exceed snod->len - sizeof(struct ubifs_sig_node). Patches have been merged across multiple stable branches. See Kernel Git Commit 95d27c1, Kernel Git Commit a1dc246, and Kernel Git Commit f76b79d for the mainline and stable backports.

Workarounds

Disable UBIFS support in the kernel (CONFIG_UBIFS_FS=n) on systems that do not require it
Prohibit mounting of UBIFS volumes from untrusted sources by removing user-mount permissions and udev auto-mount rules
Require offline integrity verification (checksum or external signature validation) of UBIFS images before they are mounted

bash

# Configuration example - disable non-root UBIFS mounts via udev/policy
# Remove auto-mount rules for UBI/UBIFS devices
rm -f /etc/udev/rules.d/*ubi*.rules

# Verify the running kernel includes the fix
zgrep -i 'ubifs.*signature' /proc/config.gz
uname -r