CVE-2026-89720

Received Received - Intake

Out-of-Bounds Read in Linux Kernel UBIFS Signature Handling

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field before handing the signature payload to verify_pkcs7_signature(), but the check has the wrong sign: if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node)) The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ, 64 bytes) into the node, so the payload is at most snod->len - sizeof(struct ubifs_sig_node) bytes long. Adding the header size instead of subtracting it accepts a declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds -- past the end of c->sbuf, which is vmalloc(c->leb_size). verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder() is then handed that inflated length and reads beyond the allocation while walking the DER headers. The node length comes straight from the mounted image, so a crafted signed UBIFS image reaches this via ubifs_read_superblock() before the signature is cryptographically checked. snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner (c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected subtraction cannot underflow. Legitimately signed images are unaffected: a correct superblock never declares a signature longer than the node it is embedded in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89720

EUVD

EUVD-2026-76632

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's UBIFS file system. It involves an incorrect bounds check in the signature length validation for signed UBIFS images. The code mistakenly adds the header size to the node length instead of subtracting it, allowing an attacker to declare a signature length up to twice as large as the actual node size. This leads to reading beyond allocated memory when parsing DER headers in the signature.

Detection Guidance

This vulnerability is specific to the Linux kernel's UBIFS filesystem and requires examining mounted UBIFS images for malformed signature nodes. Detection involves checking kernel logs for crashes or memory corruption during UBIFS operations, or using filesystem auditing tools to inspect UBIFS superblocks and signature nodes for invalid length fields. Commands like dmesg, journalctl, or custom scripts parsing /proc/mounts for UBIFS mounts may help identify affected systems.

Impact Analysis

If you use a Linux system with UBIFS and mount a crafted signed image, an attacker could exploit this to execute arbitrary code with kernel privileges. This could lead to system compromise, data theft, or denial of service. The vulnerability is triggered before cryptographic signature verification, making it particularly dangerous.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the UBIFS signature length check flaw. Avoid mounting untrusted UBIFS images until patched. If using signed UBIFS images, verify their integrity before mounting. Monitor kernel logs for UBIFS-related errors or crashes as potential indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-89720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70