VulnerabilityPublished 17 Sep 2026Updated 10 Nov 2026

CVE-2026-92499: Linux kernel · ext4: validate readdir offset before accessing dirent

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in bc4b7b0414c33b2c8898eb04386df0d21a13dad8 : update Linux kernel when convenient.

Data as of 10 Nov 2026, 18:19 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in bc4b7b0414c33b2c8898eb04386df0d21a13dad8, b4c728577933753180e3e97f08424d5bcaff705e, 094e8139cf5a5e37b363ac984f628359558415e6 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to bc4b7b0414c33b2c8898eb04386df0d21a13dad8, b4c728577933753180e3e97f08424d5bcaff705e, 094e8139cf5a5e37b363ac984f628359558415e6 or 64d445d40e5ea4c4d4d88880db753b370cb69161.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ ac27a0ec112a089f1a5102bc8dffc79c8c815571, < bc4b7b0414c33b2c8898eb04386df0d21a13dad8	Fixed in bc4b7b0414c33b2c8898eb04386df0d21a13dad8
LinuxLinux	Affected ≥ ac27a0ec112a089f1a5102bc8dffc79c8c815571, < b4c728577933753180e3e97f08424d5bcaff705e	Fixed in b4c728577933753180e3e97f08424d5bcaff705e
LinuxLinux	Affected ≥ ac27a0ec112a089f1a5102bc8dffc79c8c815571, < 094e8139cf5a5e37b363ac984f628359558415e6	Fixed in 094e8139cf5a5e37b363ac984f628359558415e6
LinuxLinux	Affected ≥ ac27a0ec112a089f1a5102bc8dffc79c8c815571, < 64d445d40e5ea4c4d4d88880db753b370cb69161	Fixed in 64d445d40e5ea4c4d4d88880db753b370cb69161
LinuxLinux	Affected =2.6.19	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary.

References

Community reviews

Loading reviews…