HarborGuard / CVE
Back to search
HIGHCVE-2026-31449Published Modified CNA Linux

CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes

In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code.

Metrics

CVSS v3.1
7.8
Severity
HIGH
Fixed in
0
Affected Products
2

Fix available

001bf1e0b997d82c0e353b51ed74ef99698043c332acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8407c944f217c17d4343148011acafebc604d55e14d08401aa13f1531216f1a7ae281ca4806e90a5c6.6.1406.12.806.18.216.19.117.093f2e975ed658ce09db4d4c2877ca2c06540df83
Affected packages
  • Linux / Linux
    < 4d08401aa13f1531216f1a7ae281ca4806e90a5c (from a86c61812637c7dd0c57e29880cffd477b62f2e7) · < 407c944f217c17d4343148011acafebc604d55e1 (from a86c61812637c7dd0c57e29880cffd477b62f2e7) · < 93f2e975ed658ce09db4d4c2877ca2c06540df83 (from a86c61812637c7dd0c57e29880cffd477b62f2e7) · < 01bf1e0b997d82c0e353b51ed74ef99698043c33 (from a86c61812637c7dd0c57e29880cffd477b62f2e7) · < 2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8 (from a86c61812637c7dd0c57e29880cffd477b62f2e7)
  • Linux / Linux
    2.6.19
    Fixed in 0, 6.6.140, 6.12.80, 6.18.21, 6.19.11, 7.0
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H