The vulnerability in the Linux kernel's UBIFS subsystem involved an incorrect sign in the bounds check of the on-disk ubifs_sig_node->len field before passing the signature payload to verify_pkcs7_signature(). The check erroneously added the header size instead of subtracting it, allowing a declared signature length up to twice the header size larger than the actual node size. This caused verify_pkcs7_signature() and subsequent ASN.1 parsing functions to read beyond the allocated buffer, leading to an out-of-bounds read. The flaw could be triggered by a crafted signed UBIFS image during superblock reading before cryptographic signature verification. The node length is guaranteed to be at least the header size, so the corrected subtraction does not underflow. Legitimate images are unaffected as they never declare an oversized signature.

An attacker able to supply a crafted signed UBIFS image could cause the kernel to perform an out-of-bounds read during signature verification. This could potentially lead to information disclosure or kernel memory corruption depending on the context of the read. However, legitimate signed images are not affected, and no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to correct the bounds check by subtracting the header size instead of adding it. Users should update to the patched Linux kernel version containing this fix. No additional mitigation is required for legitimately signed images.