{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()  For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name (EXT4_DIRENT_HASHES()), at an offset derived from de-\u003ename_len.  On the sb_no_casefold_compat_fallback() path ext4_match() reads that trailer, but ext4_search_dir()'s by-hand pre-check only tests de-\u003ename + de-\u003ename_len \u003c= dlimit, which proves the name fits, not the rounded trailer.  A crafted entry whose name ends at the block boundary passes the check while EXT4_DIRENT_HASHES(de) lands past the block end, so ext4_match() reads out of bounds on an ordinary lookup.  KASAN reports it as a use-after-free when the page after the directory block holds a freed object:    BUG: KASAN: use-after-free in ext4_match (fs/ext4/namei.c:1435)   Read of size 4 at addr ffff888010458000 by task exploit   Call Trace:    ext4_match (fs/ext4/namei.c:1435)    ext4_search_dir (fs/ext4/namei.c:1470)    __ext4_find_entry (fs/ext4/namei.c:1268 fs/ext4/namei.c:1632)    ext4_lookup (fs/ext4/namei.c:1703 fs/ext4/namei.c:1769)    ...    filename_lookup (fs/namei.c:2842)    vfs_statx (fs/stat.c:353)    __do_sys_newfstatat (fs/stat.c:538)    do_syscall_64 (arch/x86/entry/syscall_64.c:94)    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)  Require, for hash-in-dirent directories, that the whole entry including the rounded trailer fits before calling ext4_match().  This is the same bound ext4_check_dir_entry() already enforces via ext4_dir_rec_len(), so no well-formed entry is rejected.  The other caller, ext4_find_dest_de(), runs ext4_check_dir_entry() first and is unaffected.",
  "id": "DEBIAN-CVE-2026-89787",
  "modified": "2026-09-17T04:47:39.705061130Z",
  "published": "2026-09-16T09:17:09.460Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89787"
    }
  ],
  "upstream": [
    "CVE-2026-89787"
  ]
}