CVE-2026-89787

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker could craft a directory entry that, when processed during a directory search, leads to an out-of-bounds read. This vulnerability can result in a use-after-free condition, potentially causing a denial of service or information disclosure.

An out-of-bounds read in ext4 directory lookup can occur for casefolded encrypted directories because ext4_match may read the hash trailer even when only the file name was proven to fit inside the directory block. A crafted directory entry whose name ends at the block boundary can pass the old pre-check while the rounded hash trailer address points past the block end. KASAN reports this as a use-after-free read when the adjacent memory belongs to a freed object. For the CVSS the PR:L is used for the paranoid score because a local user may be able to trigger lookup operations on an already mounted crafted or corrupted ext4 filesystem, while creating or mounting such content usually requires higher privileges. The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to an out-of-bounds kernel read, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.