PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46094 Linux CVE debrief

A bounds check flaw in the Linux kernel's ext4 filesystem xattr validation code allows out-of-bounds memory reads. The vulnerability exists in check_xattrs() where the loop condition (void *)next >= end permits the xattr entry pointer to advance within sizeof(u32) bytes of the buffer end. On the subsequent iteration, IS_LAST_ENTRY() performs a 4-byte read that can exceed the allocated xattr region, potentially reading up to 3 bytes past valid memory. The fix adjusts the bounds check to (void *)next + sizeof(u32) > end, ensuring sufficient space remains for the IS_LAST_ENTRY() read before proceeding. This is a local vulnerability requiring crafted filesystem access; no network vector or authentication bypass is indicated.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators, container platform operators, forensic analysts processing untrusted disk images, and security teams monitoring kernel filesystem attack surface

Technical summary

The check_xattrs() function in fs/ext4/xattr.c validates extended attribute entries during ext4 filesystem operations. The loop advancing through xattr entries used a bounds check comparing (void *)next against end, which allowed next to point as close as 1 byte before end. The IS_LAST_ENTRY() macro reads 4 bytes via *(__u32 *)(entry) to test for the terminator; with next at end-1, this read accesses bytes at end-1, end, end+1, end+2—three bytes beyond the valid region. The corrected check (void *)next + sizeof(u32) > end ensures space for the full u32 read. Multiple stable tree commits indicate backports to supported kernel versions.

Defensive priority

medium

Recommended defensive actions

  • Apply stable kernel patches from Linux kernel maintainers when available for your distribution
  • Verify ext4 filesystem images from untrusted sources before mounting
  • Monitor distribution security advisories for backported fixes
  • Review systems processing external ext4 images (container runtimes, forensic tools, file servers)
  • Enable kernel lockdown or secure boot where available to reduce untrusted module attack surface

Evidence notes

Vulnerability description and fix details sourced from CVE.org record and NVD entry. Patch commits verified via kernel.org stable tree references. Vendor identification marked low confidence by source system due to 'Unknown Vendor' classification; Linux kernel is the affected product.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46094 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46094

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46094 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46094

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/520986722dbf869c122252123fc161c7302eab7d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/537e065977022aa22f2c2503e8accaf16622e0fd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5a5314d2387633a272a04d1bd8727f99058e4e68

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ab6da97bc310db35d4e4ef5354bc3ff626b0698c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/eceafc31ea7b42c984ece10d79d505c0bb6615d5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.