PT-2026-43962 · Linux · Linux
Published
2026-05-27
·
Updated
2026-05-27
·
CVE-2026-46094
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix bounds check in check xattrs() to prevent out-of-bounds access
The bounds check for the next xattr entry in check xattrs() uses
(void *)next >= end, which allows next to point within sizeof(u32)
bytes of end. On the next loop iteration, IS LAST ENTRY() reads 4
bytes via *( u32 *)(entry), which can overrun the valid xattr region.
For example, if next lands at end - 1, the check passes since
next < end, but IS LAST ENTRY() reads 4 bytes starting at end - 1,
accessing 3 bytes beyond the valid region.
Fix this by changing the check to (void *)next + sizeof(u32) > end,
ensuring there is always enough space for the IS LAST ENTRY() read
on the subsequent iteration.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux