CVE-2026-89786

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix out-of-bounds read in ext4readinline_dir()

ext4readinline_dir() can read a dirent header past the end of its inline

buffer, triggering a slab-out-of-bounds read during getdents64():

  BUG: KASAN: slab-out-of-bounds in _ext4checkdirentry

  Read of size 2 at addr ffff88800f3dd23c by task exploit/148

   ...

   _ext4checkdirentry

   ext4readinline_dir

   iterate_dir

The dirent payload lives in a buffer of exactly inline_size bytes:

dirbuf = kmalloc(inlinesize, GFP_NOFS);

but iteration runs in a position space extra_offset bytes larger

(extrasize = extraoffset + inline_size) so the synthetic "." and ".."

land at their block-dir offsets. A dirent is formed at "dir_buf + pos -

extraoffset", yet the ext4checkdirentry() length argument uses the

larger extra_size. A position whose dirent header would extend past

extrasize is therefore accepted, and the rescan loop's reclen probe and

ext4checkdirentry() dereference de->reclen before the entry is rejected.

Reject a position whose minimum-size dirent header would not fit within

extra_size before forming de, in both the rescan and main loops, and pass

inlinesize rather than extrasize to ext4checkdir_entry() so the length

check matches the physical buffer.