{"id":"CVE-2026-31449","state":"PUBLISHED","title":"ext4: validate p_idx bounds in ext4_ext_correct_indexes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.","publishedAt":"2026-04-22T13:53:44.777Z","updatedAt":"2026-10-19T18:35:48.867Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"39d6e2b67651614bac0dc6592fa9836321910067","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"c5839b34704c9c2f47f079451bdbb22de0da1ed1","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"10242e640b36b91ad03d25f3dc77854bbdff8358","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"4d08401aa13f1531216f1a7ae281ca4806e90a5c","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"407c944f217c17d4343148011acafebc604d55e1","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"93f2e975ed658ce09db4d4c2877ca2c06540df83","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"01bf1e0b997d82c0e353b51ed74ef99698043c33","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/extents.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.19","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/extents.c"]}],"references":["https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067","https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1","https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358","https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c","https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1","https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83","https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33","https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31449.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31449","state":"PUBLISHED","datePublished":"2026-04-22T13:53:44.777Z","dateUpdated":"2026-10-19T18:35:48.867Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.091Z"},"containers":{"cna":{"title":"ext4: validate p_idx bounds in ext4_ext_correct_indexes","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"39d6e2b67651614bac0dc6592fa9836321910067","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"c5839b34704c9c2f47f079451bdbb22de0da1ed1","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"10242e640b36b91ad03d25f3dc77854bbdff8358","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"4d08401aa13f1531216f1a7ae281ca4806e90a5c","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"407c944f217c17d4343148011acafebc604d55e1","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"93f2e975ed658ce09db4d4c2877ca2c06540df83","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"01bf1e0b997d82c0e353b51ed74ef99698043c33","versionType":"git"},{"version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","status":"affected","lessThan":"2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/extents.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.19","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/extents.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067"},{"url":"https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1"},{"url":"https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358"},{"url":"https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c"},{"url":"https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1"},{"url":"https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83"},{"url":"https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33"},{"url":"https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable ext4 code is reached through local filesystem operations such as pwrite64, fallocate, or truncate on a mounted ext4 filesystem. It is not directly reachable through network packets, and physical access is not strictly required because a crafted filesystem image can be supplied as a local/block-device image.\nAC:L - Once the crafted/corrupted extent metadata is present on a mounted filesystem, the trigger is a straightforward file write or extent update with no race or condition outside the attacker's control. Syzbot reproduced it through the ordinary buffered-write path.\nPR:N - In the highest-severity defensible scenario, the attacker supplies a malicious ext4 image and relies on a victim/admin or automount workflow to mount it, so the attacker needs no privileges on the target. Ext4 is not user-namespace mountable, but that mount requirement is captured as user interaction rather than attacker privileges.\nUI:R - Exploitation requires the crafted ext4 filesystem to be mounted and then operated on, such as by writing to the crafted file. There is no pre-authentication or autonomous network-facing path into this code.\nS:U - The impact is within the kernel/filesystem security authority of the same host. This is not a guest-to-host escape or another cross-scope boundary violation.\nC:H - The bug is a slab out-of-bounds access from an attacker-controlled extent-tree pointer, which can expose adjacent kernel memory in a corrupted heap layout. Under the required overestimation rule, this memory-corruption primitive supports high confidentiality impact.\nI:H - The unchecked p_idx is used to update ei_block, so an out-of-bounds pointer can corrupt memory or filesystem metadata beyond the valid extent index entry. Such kernel memory corruption is defensibly treated as high integrity impact.\nA:H - The reported failure is a KASAN slab-out-of-bounds fault in kernel ext4 code and can cause an oops/panic or filesystem failure. Repeated triggering through file operations can deny availability of the host or mounted filesystem."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:22:39.911Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.19","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:16:21.884Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-31449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:09:29.200842Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:35:48.867Z"}}]}}}