CVE-2026-89786

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix out-of-bounds read in ext4_read_inline_dir()

ext4_read_inline_dir() can read a dirent header past the end of its inline

buffer, triggering a slab-out-of-bounds read during getdents64():

BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry

Read of size 2 at addr ffff88800f3dd23c by task exploit/148

...

__ext4_check_dir_entry

ext4_read_inline_dir

iterate_dir

The dirent payload lives in a buffer of exactly inline_size bytes:

dir_buf = kmalloc(inline_size, GFP_NOFS);

but iteration runs in a position space extra_offset bytes larger

(extra_size = extra_offset + inline_size) so the synthetic "." and ".."

land at their block-dir offsets. A dirent is formed at "dir_buf + pos -

extra_offset", yet the ext4_check_dir_entry() length argument uses the

larger extra_size. A position whose dirent header would extend past

extra_size is therefore accepted, and the rescan loop's rec_len probe and

ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.

Reject a position whose minimum-size dirent header would not fit within

extra_size before forming de, in both the rescan and main loops, and pass

inline_size rather than extra_size to ext4_check_dir_entry() so the length

check matches the physical buffer.