CVE-2026-31449 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code.
A vulnerability in the Linux kernel's ext4 file system has been addressed, concerning the validation of index pointers in the extent tree. The issue arises in the function 'ext4_ext_correct_indexes()', which corrects index entries when the first extent of a leaf is modified. The vulnerability exists because there was no prior validation of the index pointer against the valid range of index entries. If the on-disk extent header contains a corrupted or crafted entry, the pointer could be manipulated to read beyond the allocated buffer, leading to a slab-out-of-bounds read. This vulnerability has been fixed by adding the necessary validation and returning an error code if the index pointer is out of range.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.19.1, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 2.6.19 - 2.6.19 rc2 2.6.19 rc3 2.6.19 rc4 2.6.19 rc5 2.6.19 rc6 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | siemens-SADP |
| Sep 8, 2026 | CVE Modified | kernel.org |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 22, 2026 | New CVE Received | kernel.org |