---
id: CVE-2026-89786
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: fix out-of-bounds read in ext4_read_inline_dir()

  ext4_read_inline_dir() can read a dirent header past the end of its inline
  buffer, triggering a slab-out-of-boun…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: fix out-of-bounds read in ext4_read_inline_dir()

  ext4_read_inline_dir() can read a dirent header past the end of its inline
  buffer, triggering a slab-out-of-boun…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    d1e7c186555ad65554fd2f2b02f5a539aa35ae48
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    5fd20d4e50dd6e460b3ea8e4396f8553d4526f8f
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    1a1dea633b724a1c042dbcdb1fed27f410916688
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    b060861f662d4826dc700a1c3584243bb3474cfe
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    6702c7da86d8cdb88d0fc57166286e115ffeb8c0
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    36bf17bb90cdf7a623499b624b05acde4d2feef5
  - >-
    Linux >= c4d8b0235aa98f8c26bf94d308be3fdd24154572 <
    9333cc809f0a89e001b814155a6cb8903a6274df
  - Linux 3.10
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:08.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89786'
references:
  - url: 'https://git.kernel.org/stable/c/1a1dea633b724a1c042dbcdb1fed27f410916688'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/36bf17bb90cdf7a623499b624b05acde4d2feef5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5fd20d4e50dd6e460b3ea8e4396f8553d4526f8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6702c7da86d8cdb88d0fc57166286e115ffeb8c0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9333cc809f0a89e001b814155a6cb8903a6274df'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b060861f662d4826dc700a1c3584243bb3474cfe'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d1e7c186555ad65554fd2f2b02f5a539aa35ae48'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T08:52:29.590Z'
epss: 0.00688
epssPercentile: 0.51286
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix out-of-bounds read in ext4_read_inline_dir()

ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():

  BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry
  Read of size 2 at addr ffff88800f3dd23c by task exploit/148
   ...
   __ext4_check_dir_entry
   ext4_read_inline_dir
   iterate_dir

The dirent payload lives in a buffer of exactly inline_size bytes:

	dir_buf = kmalloc(inline_size, GFP_NOFS);

but iteration runs in a position space extra_offset bytes larger
(extra_size = extra_offset + inline_size) so the synthetic "." and ".."
land at their block-dir offsets. A dirent is formed at "dir_buf + pos -
extra_offset", yet the ext4_check_dir_entry() length argument uses the
larger extra_size. A position whose dirent header would extend past
extra_size is therefore accepted, and the rescan loop's rec_len probe and
ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.

Reject a position whose minimum-size dirent header would not fit within
extra_size before forming de, in both the rescan and main loops, and pass
inline_size rather than extra_size to ext4_check_dir_entry() so the length
check matches the physical buffer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.