{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ext4: validate readdir offset before accessing dirent  A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position:    BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820   Read of size 2 at addr ffff88810a646000 by task repro_linear/509    Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x53/0x70    print_report+0xd0/0x630    kasan_report+0xce/0x100    __ext4_check_dir_entry+0x5ef/0x820    ext4_readdir+0xcde/0x2b70    iterate_dir+0x1a1/0x520    __x64_sys_getdents64+0x12b/0x220    do_syscall_64+0xf9/0x540    entry_SYSCALL_64_after_hwframe+0x77/0x7f    \u003c/TASK\u003e  KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced.  ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de-\u003erec_len before validating the range. For example:    block offset  0                           4092  4096                 |---- de1.rec_len = 4092 -----|----|                                                de2.inode                                                     | de2.rec_len                                                     ^ OOB, reported as UAF  de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary.  The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes.  Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary.",
  "id": "DEBIAN-CVE-2026-92499",
  "modified": "2026-09-18T04:47:30.210790715Z",
  "published": "2026-09-17T17:17:52.280Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-92499"
    }
  ],
  "upstream": [
    "CVE-2026-92499"
  ]
}