CVE-2026-31449ext4: validate p_idx bounds in ext4_ext_correct_indexes
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 39d6e2b67651614bac0dc6592fa9836321910067; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before c5839b34704c9c2f47f079451bdbb22de0da1ed1; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 10242e640b36b91ad03d25f3dc77854bbdff8358; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 4d08401aa13f1531216f1a7ae281ca4806e90a5c; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 407c944f217c17d4343148011acafebc604d55e1; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 93f2e975ed658ce09db4d4c2877ca2c06540df83; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 01bf1e0b997d82c0e353b51ed74ef99698043c33; from a86c61812637c7dd0c57e29880cffd477b62f2e7 before 2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.19.1 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 2.6.19; 2.6.19; 2.6.19; 2.6.19; 2.6.19; and 6 more ranges | NVD |
References
- https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067
- https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1
- https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358
- https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c
- https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1patch
- https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83patch
- https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33patch
- https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8patch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.