CVE-2026-46094

A flaw was found in the Linux kernel's ext4 filesystem, specifically in the check_xattrs() function. A local attacker could exploit a bounds check error, allowing an out-of-bounds read when processing extended attributes (xattrs). This could lead to memory corruption, potentially causing a denial of service or information disclosure.

An out-of-bounds read in ext4 check_xattrs() can occur because the next xattr entry was only checked against end, while the next loop iteration reads 4 bytes through IS_LAST_ENTRY(). A malformed xattr layout can place the next entry pointer within the last 1 to 3 bytes of the valid xattr region, causing a small overread beyond that region. For the CVSS the PR:L is used in the paranoid score because some environments allow less trusted local users or delegated mount contexts to supply filesystem images, while the realistic default case often requires administrative mount or block device control. The issue is not network reachable and requires local filesystem metadata processing. Impact is at least denial of service or invalid kernel memory read behavior, and in the worst still defensible case may allow limited confidentiality or integrity impact due to parser state confusion, but there is no evidence of an out-of-bounds write or UAF primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.