---
cve: "CVE-2026-89787"
severity: "LOW"
cvss: 3.1
epss: "21%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-16 09:17:09"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-17T08:44:06+02:00"
---

# CVE-2026-89787

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

For casefolded encrypted directories ext4 stores an 8-byte hash trailer
after the name (EXT4_DIRENT_HASHES()), at an offset derived from
de->name_len.  On the sb_no_casefold_compat_fallback() path ext4_match()
reads that trailer, but ext4_search_dir()'s by-hand pre-check only tests
de->name + de->name_len

## Patch verfügbar (OSV)

- Kernel ≥ 5.15.221
- Kernel ≥ 6.1.188
- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.110
- Kernel ≥ 6.18.52
- Kernel ≥ 7.2.6

## Referenzen

- <https://git.kernel.org/stable/c/4d20106c536b73c4a8a02652dc85e35898baebf7>
- <https://git.kernel.org/stable/c/61a395967de06edba58760e81907a272db749faa>
- <https://git.kernel.org/stable/c/e94676a08af6312aa72d8a981232b281f9bcfcf5>
- <https://git.kernel.org/stable/c/d8c184bec24b5a00ae96d704856d935eaded1685>
- <https://git.kernel.org/stable/c/3933884bc3102898b458c53fbd1ac52eb9cdb8a4>
- <https://git.kernel.org/stable/c/83663c0b739480c00cfe785675db87520ec484ed>
- <https://git.kernel.org/stable/c/c7e6b863d298f56522d0d08554bbea7f142e6588>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89787) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_