{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ext4: fix out-of-bounds read in ext4_read_inline_dir()  ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64():    BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry   Read of size 2 at addr ffff88800f3dd23c by task exploit/148    ...    __ext4_check_dir_entry    ext4_read_inline_dir    iterate_dir  The dirent payload lives in a buffer of exactly inline_size bytes:  \tdir_buf = kmalloc(inline_size, GFP_NOFS);  but iteration runs in a position space extra_offset bytes larger (extra_size = extra_offset + inline_size) so the synthetic \".\" and \"..\" land at their block-dir offsets. A dirent is formed at \"dir_buf + pos - extra_offset\", yet the ext4_check_dir_entry() length argument uses the larger extra_size. A position whose dirent header would extend past extra_size is therefore accepted, and the rescan loop's rec_len probe and ext4_check_dir_entry() dereference de-\u003erec_len before the entry is rejected.  Reject a position whose minimum-size dirent header would not fit within extra_size before forming de, in both the rescan and main loops, and pass inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches the physical buffer.",
  "id": "DEBIAN-CVE-2026-89786",
  "modified": "2026-09-17T04:47:37.366521751Z",
  "published": "2026-09-16T09:17:09.330Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89786"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89786"
  ]
}