CVE-2026-31449 ext4: validate p_idx bounds in ext4_ext_correct_indexes
A local attacker can trigger a slab-out-of-bounds read in the ext4 filesystem by crafting a corrupted extent header, potentially causing a system crash or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-31449?
CVE-2026-31449 is a high-severity memory corruption vulnerability in Linux kernel, published on 22 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ext4: validate p_idx bounds in ext4_ext_correct_indexes
ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level.
If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read.
Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code.
Weakness: CWE-125
Which versions are affected by CVE-2026-31449?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31449?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31449 being exploited?
There is no known exploitation of CVE-2026-31449 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83273, BELL-CVE-2026-31449, DEBIAN-CVE-2026-31449, GHSA-rq43-8p3g-5cc4, ROOT-OS-DEBIAN-11-CVE-2026-31449, ROOT-OS-DEBIAN-12-CVE-2026-31449 and 4 more.