HIGH
ext4 IndexTree OOB
CVE-2026-31449
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
KernelScan AI4.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code.
02KernelScan AI Analysis
Risk summary
Systems that mount untrusted ext4 filesystems are at risk of kernel memory disclosure and system crashes. Attackers with root privileges can exploit crafted filesystem images to read kernel memory contents or cause denial of service through kernel panics.
Vulnerability analysis
The vulnerability occurs in ext4_ext_correct_indexes() when walking the extent tree to correct index entries. The function dereferences path[k].p_idx without validating it falls within the allocated buffer bounds, allowing corrupted eh_entries values in the on-disk extent header to cause slab-out-of-bounds reads. The fix adds bounds validation against EXT_LAST_INDEX() at both access sites and returns -EFSCORRUPTED on violation. Attack surface is local-only, requiring root privileges to mount crafted filesystems, but can be triggered through removable media or network-mounted storage.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.1 | 6.1.175 | 10242e640b36 |
| 6.12 | 6.12.80 | 407c944f217c |
| 6.18 | 6.18.21 | 93f2e975ed65 |
| 6.19 | 6.19.11 | 01bf1e0b997d |
| 6.6 | 6.6.140 | 4d08401aa13f |
| mainline | 7.0 | 2acb5c12ebd8 |