PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46094 Linux CVE debrief

A bounds check flaw in the Linux kernel's ext4 filesystem xattr validation code allows out-of-bounds memory reads. The vulnerability exists in check_xattrs() where the loop condition (void *)next >= end permits the xattr entry pointer to advance within sizeof(u32) bytes of the buffer end. On the subsequent iteration, IS_LAST_ENTRY() performs a 4-byte read that can exceed the allocated xattr region, potentially reading up to 3 bytes past valid memory. The fix adjusts the bounds check to (void *)next + sizeof(u32) > end, ensuring sufficient space remains for the IS_LAST_ENTRY() read before proceeding. This is a local vulnerability requiring crafted filesystem access; no network vector or authentication bypass is indicated.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, container platform operators, forensic analysts processing untrusted disk images, and security teams monitoring kernel filesystem attack surface

Technical summary

The check_xattrs() function in fs/ext4/xattr.c validates extended attribute entries during ext4 filesystem operations. The loop advancing through xattr entries used a bounds check comparing (void *)next against end, which allowed next to point as close as 1 byte before end. The IS_LAST_ENTRY() macro reads 4 bytes via *(__u32 *)(entry) to test for the terminator; with next at end-1, this read accesses bytes at end-1, end, end+1, end+2—three bytes beyond the valid region. The corrected check (void *)next + sizeof(u32) > end ensures space for the full u32 read. Multiple stable tree commits indicate backports to supported kernel versions.

Defensive priority

medium

Recommended defensive actions

  • Apply stable kernel patches from Linux kernel maintainers when available for your distribution
  • Verify ext4 filesystem images from untrusted sources before mounting
  • Monitor distribution security advisories for backported fixes
  • Review systems processing external ext4 images (container runtimes, forensic tools, file servers)
  • Enable kernel lockdown or secure boot where available to reduce untrusted module attack surface

Evidence notes

Vulnerability description and fix details sourced from CVE.org record and NVD entry. Patch commits verified via kernel.org stable tree references. Vendor identification marked low confidence by source system due to 'Unknown Vendor' classification; Linux kernel is the affected product.

Official resources

Disclosed 2026-05-27 via Linux kernel stable tree commits. CVE published same day. No CISA KEV entry. No CVSS score assigned by NVD at time of disclosure.