Threats Tagged 'cve-2026-46094'

A vulnerability in the Linux kernel's ext4 filesystem code allows an out-of-bounds read due to an improper bounds check in the check_xattrs() function. The issue arises because the bounds check permits a pointer to be within sizeof(u32) bytes of the end of the valid region, leading to a 4-byte read beyond the valid memory area. This can cause a high-severity impact including potential denial of service due to memory corruption. The vulnerability affects version 3.0 of the Linux kernel ext4 code as specified. A fix involves adjusting the bounds check to ensure sufficient space for the 4-byte read. No patch link is provided in the data, and no known exploits are reported in the wild.

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access The bounds check for the next xattr entry in check_xattrs() uses (void *)next >= end, which allows next to point within sizeof(u32) bytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4 bytes via *(__u32 *)(entry), which can overrun the valid xattr region. For example, if next lands at end - 1, the check passes since next < end, but IS_LAST_ENTRY() reads 4 bytes starting at end - 1, accessing 3 bytes beyond the valid region. Fix this by changing the check to (void *)next + sizeof(u32) > end, ensuring there is always enough space for the IS_LAST_ENTRY() read on the subsequent iteration.