CVE-2026-31449

HIGH EPSS 3.3%
Published Apr 22, 20262mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Apr 22, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 14

VendorProductVersionRange
linuxlinux_kernel*≥2.6.19.1  –  <6.12.80
linuxlinux_kernel*≥6.13  –  <6.18.21
linuxlinux_kernel*≥6.19  –  <6.19.11
linuxlinux_kernel2.6.19any
linuxlinux_kernel2.6.19any
linuxlinux_kernel2.6.19any
linuxlinux_kernel2.6.19any
linuxlinux_kernel2.6.19any
linuxlinux_kernel2.6.19any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 6

  • git.kernel.org https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358
  • git.kernel.org https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c
  • git.kernel.org https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83
    Patch