CVE-2026-89787: Linux Kernel ext4 Use-After-Free Vulnerability

CVE-2026-89787 Overview

CVE-2026-89787 is an out-of-bounds read vulnerability in the Linux kernel's ext4 filesystem. The flaw resides in ext4_search_dir() when handling casefolded encrypted directories. For these directories, ext4 stores an 8-byte hash trailer after the entry name via EXT4_DIRENT_HASHES(). The pre-check in ext4_search_dir() only validates that the name fits within the directory block, not that the rounded trailer also fits. A crafted directory entry whose name ends at the block boundary passes the check, causing ext4_match() to read past the block during ordinary lookups.

Critical Impact
A crafted ext4 directory entry triggers an out-of-bounds read during directory lookup, reported by KASAN as a use-after-free, enabling kernel memory disclosure or denial of service.

Affected Products

Linux kernel (upstream) — ext4 filesystem subsystem
Kernel builds with casefolded encrypted directory support (sb_no_casefold_compat_fallback() path)
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89787 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89787

Vulnerability Analysis

The vulnerability affects casefolded encrypted directories in ext4, which store an 8-byte hash trailer after each entry's name. The trailer offset is derived from de->name_len and is accessed through the EXT4_DIRENT_HASHES() macro. On the sb_no_casefold_compat_fallback() code path, ext4_match() reads this trailer as part of name matching.

The hand-rolled bounds check inside ext4_search_dir() only validates that de->name + de->name_len <= dlimit. That check proves the name itself fits within the directory block. It does not validate that the rounded hash trailer also fits. When a directory entry's name terminates exactly at the block boundary, the trailer computed by EXT4_DIRENT_HASHES(de) lands past the block end.

KASAN identifies the resulting 4-byte read as a use-after-free when the adjacent page holds a freed object. The read can leak kernel memory contents into matching logic and destabilize the kernel. Triggering the flaw only requires a stat-class syscall against a crafted directory.

Root Cause

The root cause is an incomplete boundary validation [CWE-125] in fs/ext4/namei.c. The pre-check enforces bounds on the entry name but omits the trailing hash bytes required by hash-in-dirent directories. ext4_check_dir_entry() already enforces the correct bound via ext4_dir_rec_len(), but ext4_search_dir() did not apply the same rule before invoking ext4_match().

Attack Vector

An attacker with the ability to mount or supply a crafted ext4 filesystem image, or to write specific directory entries on a vulnerable filesystem, can trigger the out-of-bounds read. The flaw is reached through ordinary VFS paths including filename_lookup(), vfs_statx(), and __do_sys_newfstatat(). Exploitation does not require elevated privileges beyond directory access, though the practical attack surface depends on whether untrusted filesystems can be mounted.

The fix requires that the entire entry, including the rounded trailer, fits before ext4_match() is called. See the upstream fix commits including 3933884, 4d20106, and c7e6b86 for the corrected bounds check.

Detection Methods for CVE-2026-89787

Indicators of Compromise

KASAN reports of use-after-free in ext4_match at fs/ext4/namei.c:1435 in kernel logs
Unexpected kernel oops or panics originating from ext4_search_dir() or __ext4_find_entry() call stacks
Mount events for untrusted ext4 images followed by anomalous stat, openat, or newfstatat syscall failures

Detection Strategies

Enable KASAN on test kernels and exercise directory lookup workloads against suspect ext4 images to surface out-of-bounds reads
Monitor dmesg and journald for ext4 corruption warnings emitted by ext4_check_dir_entry() on production hosts
Audit filesystem mount telemetry for user-mountable ext4 volumes on multi-tenant or endpoint systems

Monitoring Recommendations

Ship kernel ring buffer and audit logs to a centralized data lake for correlation of ext4 error patterns across fleets
Alert on new mounts of removable or loop-mounted ext4 filesystems by non-root users
Track kernel version inventory to identify hosts still running pre-patch stable branches

How to Mitigate CVE-2026-89787

Immediate Actions Required

Apply the upstream ext4 fix commits to affected stable kernel branches and rebuild
Update to a distribution kernel that includes the corrected bounds check in ext4_search_dir()
Restrict the ability of unprivileged users to mount arbitrary ext4 filesystems, including USB and loopback images

Patch Information

The fix adds a requirement that, for hash-in-dirent directories, the whole entry including the rounded trailer must fit before ext4_match() is invoked. This aligns the check with the bound already enforced by ext4_check_dir_entry() via ext4_dir_rec_len(), so no well-formed entry is rejected. Upstream commits include 3933884, 4d20106, 61a3959, 83663c0, c7e6b86, d8c184b, and e94676a.

Workarounds

Disable automatic mounting of removable media and untrusted disk images via udev or desktop mount helpers
Avoid enabling casefold and encryption features together on ext4 volumes exposed to untrusted content until patched
Enforce least-privilege on user namespaces to prevent unprivileged mounting of attacker-supplied filesystems

bash

# Verify running kernel version and check for the ext4 fix
uname -r

# Restrict unprivileged user namespace mounting on systems where feasible
sysctl -w kernel.unprivileged_userns_clone=0

# Disable automount for removable media in udisks2
mkdir -p /etc/udisks2
cat <<EOF >/etc/udisks2/mount_options.conf
[defaults]
auto_mount=false
EOF