CVE-2026-89786
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In the Linux kernel, ext4_read_inline_dir() has an out-of-bounds read. Directory iteration uses a larger extra_size than the actual inline_size buffer, allowing a dirent header to be read past the end of the buffer, potentially leading to information disclosure or crash.
Risk Assessment
A local attacker could exploit this to read kernel memory out of bounds, potentially revealing sensitive data or causing a system crash.
Recommendation
Apply the Linux kernel patch that rejects positions whose dirent header does not fit within extra_size and passes inline_size to ext4_check_dir_entry().
Other vulnerabilities in Linux kernel
See all- CVE-2026-90046High
In the Linux kernel, free_pages_nolock() uses spin_trylock() in NMI context on uniprocessor (UP) systems, which is unsafe. The bug affects the page freeing path and can crash the kernel. It is likely exploitable by local attackers for privilege escalation.
- CVE-2026-90045High
In the Linux kernel USB gadget ffs driver, the io_data structure stores a pointer to the submitting task's mm_struct but does not hold a reference while async requests are pending. This can cause a use-after-free if the task exits before completion handling finishes. The fix takes a reference with mmgrab() when queuing and releases it with mmdrop() on completion.
- CVE-2026-90044High
In the Linux kernel USB gadget f_fs driver, a use-after-free exists in the AIO error path. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed, but the kiocb cancel function remains armed and points to the freed pointer. A concurrent cancel (e.g., sys_io_cancel()) can cause a use-after-free. The fix safely disarms the cancellation via kiocb->ki_complete() and returns -EIOCBQUEUED.
- CVE-2026-90043High
In the Linux kernel zram module, the slot lock bit is set in the wrong position on 64-bit big-endian systems. Instead of landing in the flags field, it lands in ac_time, so with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time wipes out the held lock bit and lets another CPU take the same slot lock. An access time value with that bit set can make the slot appear locked forever. The fix shifts the lock bit into the flags half on big-endian 64-bit.
- CVE-2026-90041High
In the Linux kernel, the HID sony driver fails to remove a controller from the device list when HID core input device registration fails. The devres-managed sony_sc is freed while its list node remains linked, leading to use-after-free when the next matching controller is handled.
- CVE-2026-90039Unknown
In the Linux kernel, NFSD admin state-revocation handlers (unlock_filesystem, NFSD_CMD_UNLOCK_FILESYSTEM, NFSD_CMD_UNLOCK_EXPORT) only check nn->nfsd_serv, which is set before nn->conf_id_hashtbl is allocated. This leads to a NULL dereference when the server has not yet started.
- CVE-2026-90035Unknown
In the Linux kernel, get_estimated_bw() in the drm/amd/display driver divides by bw_granularity, which is zeroed and only populated after DP_TUNNELING_BW_ALLOC_CAP_CHANGED is handled. If a USB4/DPIA device reports an estimated-bandwidth change before a capability change, the DPCD interrupt handler triggers a division by zero.
- CVE-2026-90034Unknown
In the Linux kernel, the usb image mdc800 driver uses kmalloc() for irq_urb_buffer and download_urb_buffer in usb_mdc800_init(). If a shorter message is received in mdc800_usb_irq() or mdc800_usb_download_notify(), stack data may leak.
- CVE-2026-90033Unknown
In the Linux kernel, snd_usbmidi_us122l_output() in ALSA usb-audio picks a count of 2 for anything slower than high speed without relating it to ep->max_transfer. With a device declaring a one-byte bulk endpoint, the memset computes 1 - 2 in int and wraps to SIZE_MAX, causing an out-of-bounds write.
- CVE-2026-90024Unknown
A null-pointer dereference vulnerability exists in the Linux kernel's USB gadget MIDI 2.0 function, specifically in f_midi2_free_ep_reqs(). When configuring a MIDI 2.0 gadget via configfs with block direction set to SNDRV_UMP_DIR_INPUT, the midi1_ep_out endpoint is not initialized, leaving usb_ep->card as NULL. When the host later sets the alternate setting, f_midi2_free_ep_reqs() is called for the uninitialized endpoint, causing a kernel crash.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64(): BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry Read of size 2 at addr ffff88800f3dd23c by task exploit/148 ... __ext4_check_dir_entry ext4_read_inline_dir iterate_dir The dirent payload lives in a buffer of exactly inline_size bytes: dir_buf = kmalloc(inline_size, GFP_NOFS); but iteration runs in a position space extra_offset bytes larger (extra_size = extra_offset + inline_size) so the synthetic "." and ".." land at their block-dir offsets. A dirent is formed at "dir_buf + pos - extra_offset", yet the ext4_check_dir_entry() length argument uses the larger extra_size. A position whose dirent header would extend past extra_size is therefore accepted, and the rescan loop's rec_len probe and ext4_check_dir_entry() dereference de->rec_len before the entry is rejected. Reject a position whose minimum-size dirent header would not fit within extra_size before forming de, in both the rescan and main loops, and pass inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches the physical buffer.