CVE-2026-89786: Linux Kernel ext4 Buffer Overflow Vulnerability

CVE-2026-89786 Overview

CVE-2026-89786 is an out-of-bounds read vulnerability in the Linux kernel's ext4 filesystem, specifically within the ext4_read_inline_dir() function. The flaw allows a dirent header to be read past the end of an inline directory buffer, producing a slab-out-of-bounds condition detected by Kernel Address Sanitizer (KASAN) during getdents64() syscalls. The issue affects kernels that support ext4 inline directory entries and has been resolved upstream through multiple stable-branch commits.

Critical Impact
Attackers with the ability to trigger directory iteration on a crafted ext4 inline directory can read kernel memory beyond the allocated inline buffer, potentially leaking sensitive kernel data or causing kernel instability.

Affected Products

Linux kernel versions containing the vulnerable ext4_read_inline_dir() implementation
Distributions shipping ext4 with inline directory support prior to the fix commits
Systems mounting ext4 filesystems with the inline_data feature enabled

Discovery Timeline

2026-09-16 - CVE-2026-89786 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89786

Vulnerability Analysis

The vulnerability resides in the ext4 filesystem's inline directory reading logic. When ext4 stores small directories inline within the inode, ext4_read_inline_dir() allocates a buffer sized exactly to inline_size using kmalloc(inline_size, GFP_NOFS). However, directory iteration operates in a position space that is extra_offset bytes larger than the physical buffer, where extra_size = extra_offset + inline_size. This layout accommodates synthetic . and .. entries at their expected block-directory offsets.

The iterator forms a dirent at dir_buf + pos - extra_offset while passing extra_size as the length argument to ext4_check_dir_entry(). This mismatch causes the validator to accept a position whose dirent header extends past the physical buffer boundary. The rescan loop's rec_len probe and ext4_check_dir_entry() then dereference de->rec_len before the entry is properly rejected, producing the out-of-bounds read.

Root Cause

The root cause is a length-argument mismatch between the physical inline buffer size (inline_size) and the logical iteration size (extra_size) used by validation. The bounds check permits positions whose minimum dirent header would not fit within the allocated kmalloc slab region, resulting in a slab-out-of-bounds read of 2 bytes when accessing de->rec_len.

Attack Vector

An attacker crafts or manipulates an ext4 inline directory such that iteration lands on a position where the dirent header would cross the physical buffer boundary. Invoking getdents64() against this directory triggers the out-of-bounds read in __ext4_check_dir_entry. Exploitation requires the ability to mount or interact with a malicious ext4 filesystem image, or to reach an existing vulnerable inline directory through normal filesystem calls.

// Vulnerability mechanism (conceptual)
// dir_buf is allocated at inline_size bytes:
//     dir_buf = kmalloc(inline_size, GFP_NOFS);
// but iteration uses extra_size = extra_offset + inline_size
// A dirent formed at (dir_buf + pos - extra_offset) may extend
// past inline_size while still fitting within extra_size,
// causing __ext4_check_dir_entry() to read de->rec_len
// beyond the kmalloc slab boundary.

Detection Methods for CVE-2026-89786

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in __ext4_check_dir_entry in kernel logs
Kernel oops or panic traces including ext4_read_inline_dir and iterate_dir frames
Unexpected process termination or filesystem errors during getdents64() calls on ext4 mounts

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds reads originating from ext4 inline directory iteration
Monitor dmesg and system journals for ext4 directory entry validation errors and slab access warnings
Audit mount events for user-supplied ext4 images, particularly on multi-tenant or workstation systems permitting removable media

Monitoring Recommendations

Collect kernel ring buffer output centrally and alert on ext4-related KASAN or BUG traces
Track filesystem mount operations involving untrusted ext4 images through auditd rules
Correlate process crashes invoking getdents/getdents64 with recent ext4 filesystem activity

How to Mitigate CVE-2026-89786

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and rebuild affected kernels
Restrict the ability of unprivileged users to mount arbitrary ext4 filesystem images
Prioritize patching on multi-user systems, container hosts, and endpoints that process untrusted removable media

Patch Information

The fix rejects any position whose minimum-size dirent header would not fit within extra_size before forming the dirent, in both the rescan and main loops. It also passes inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches the physical buffer. Fixes are available in the following stable-tree commits: 1a1dea6, 36bf17b, 5fd20d4, 6702c7d, 9333cc8, b060861, and d1e7c18.

Workarounds

Disable the inline_data ext4 feature on new filesystems where compatibility permits
Block automount of untrusted removable ext4 media through udev or systemd policy
Enforce user namespace and mount restrictions to prevent unprivileged mounting of attacker-controlled filesystem images

bash

# Prevent unprivileged users from mounting arbitrary filesystems
sysctl -w kernel.unprivileged_userns_clone=0

# Disable automount of removable media (systemd example)
systemctl mask udisks2.service

# Create new ext4 filesystems without inline_data support
mkfs.ext4 -O ^inline_data /dev/sdX1