CVE-2026-92499

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker with the ability to create or manipulate a corrupted directory can trigger a use-after-free vulnerability. This occurs when the ext4_readdir() function attempts to read directory entries from an invalid offset, leading to an out-of-bounds memory access. This can result in memory corruption, potentially causing a system crash or denial of service.

This flaw is rated as having a Moderate impact for Red Hat Enterprise Linux environments because exploitation is confined to local users who must have the privileges necessary to mount or provide a malformed ext4 filesystem image. Under default system configurations, unprivileged accounts cannot mount arbitrary block devices, significantly limiting the exposure. Successful exploitation leads primarily to kernel memory corruption and an associated system crash or denial of service, without directly granting arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.