{"id":24444,"date":"2026-09-16T20:32:19","date_gmt":"2026-09-16T12:32:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89787"},"modified":"2026-09-16T20:32:19","modified_gmt":"2026-09-16T12:32:19","slug":"cve-2026-89787","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89787","title":{"rendered":"CVE-2026-89787 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\next4: check dir entry"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()<\/p>\n<p>For casefolded encrypted directories ext4 stores an 8-byte hash trailer<br \/>\nafter the name (EXT4_DIRENT_HASHES()), at an offset derived from<br \/>\nde-&gt;name_len.  On the sb_no_casefold_compat_fallback() path ext4_match()<br \/>\nreads that trailer, but ext4_search_dir()&#8217;s by-hand pre-check only tests<br \/>\nde-&gt;name + de-&gt;name_len &lt;= dlimit, which proves the name fits, not the<br \/>\nrounded trailer.  A crafted entry whose name ends at the block boundary<br \/>\npasses the check while EXT4_DIRENT_HASHES(de) lands past the block end,<br \/>\nso ext4_match() reads out of bounds on an ordinary lookup.  KASAN reports<br \/>\nit as a use-after-free when the page after the directory block holds a<br \/>\nfreed object:<\/p>\n<p>  BUG: KASAN: use-after-free in ext4_match (fs\/ext4\/namei.c:1435)<br \/>\n  Read of size 4 at addr ffff888010458000 by task exploit<br \/>\n  Call Trace:<br \/>\n   ext4_match (fs\/ext4\/namei.c:1435)<br \/>\n   ext4_search_dir (fs\/ext4\/namei.c:1470)<br \/>\n   __ext4_find_entry (fs\/ext4\/namei.c:1268 fs\/ext4\/namei.c:1632)<br \/>\n   ext4_lookup (fs\/ext4\/namei.c:1703 fs\/ext4\/namei.c:1769)<br \/>\n   &#8230;<br \/>\n   filename_lookup (fs\/namei.c:2842)<br \/>\n   vfs_statx (fs\/stat.c:353)<br \/>\n   __do_sys_newfstatat (fs\/stat.c:538)<br \/>\n   do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)<br \/>\n   entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n<p>Require, for hash-in-dirent directories, that the whole entry including<br \/>\nthe rounded trailer fits before calling ext4_match().  This is the same<br \/>\nbound ext4_check_dir_entry() already enforces via ext4_dir_rec_len(), so<br \/>\nno well-formed entry is rejected.  The other caller, ext4_find_dest_de(),<br \/>\nruns ext4_check_dir_entry() first and is unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()<\/p>\n<p>For casefolded encrypted directories ext4 stores a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24444","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24444","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24444"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24444"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24444"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}