CVE-2026-89720 - Vulnerability Details

- ubifs: fix out-of-bounds read in signature length check

Description

In the Linux kernel, the following vulnerability has been resolved:

ubifs: fix out-of-bounds read in signature length check

ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
before handing the signature payload to verify_pkcs7_signature(), but the
check has the wrong sign:

if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))

The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
64 bytes) into the node, so the payload is at most

snod->len - sizeof(struct ubifs_sig_node)

bytes long. Adding the header size instead of subtracting it accepts a
declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually
holds -- past the end of c->sbuf, which is vmalloc(c->leb_size).
verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()
is then handed that inflated length and reads beyond the allocation while
walking the DER headers. The node length comes straight from the mounted
image, so a crafted signed UBIFS image reaches this via
ubifs_read_superblock() before the signature is cryptographically checked.

snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner
(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected
subtraction cannot underflow. Legitimately signed images are unaffected: a
correct superblock never declares a signature longer than the node it is
embedded in.

Published: 2026-09-11

Score: 7.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An improper bounds check in the UBIFS superblock signature verification logic allows a crafted signed UBIFS image to cause the kernel to read beyond the allocated buffer when parsing the signature length. The flaw does not provide remote code execution; instead it can leak kernel memory contents or trigger a kernel panic due to an out‑of‑bounds read. It exists before the fix that corrects the bounds calculation, and it affects any UBIFS‑enabled Linux kernel where the signature field is present and verified.

Affected Systems

Linux kernels that employ the UBIFS file system and run a kernel version prior to the included commit are vulnerable. The flaw is present in all Linux kernel releases that expose the ubifs_sb_verify_signature routine without the subsequent patch, regardless of distribution or vendor. The affected products, as identified by the CNA, are the Linux kernel as a whole.

Risk and Exploitability

The CVSS score of 7.7 indicates serious impact, while the EPSS score of < 1% suggests very low probability of exploitation. It is not currently listed in the CISA KEV catalog. Exploitation requires the ability to supply a malicious UBIFS image to the or via remote control of a storage medium. No direct remote code execution path exists; the attacker could achieve information disclosure or denial of service if the malformed image is mounted.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< ab7405bd86331cc2dbc8201699d4adc33bea75e7
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< 11abc34698cb3172badf8aa12e623f1bac98bbd8
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< 8cc3da72cf57acb4b77442ea8cec48425dff7c06
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< 37a9d25a563f5f9103282954ce573c4a61321e7c
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< f76b79d6e42af20682495bccd22f72c7164b0018
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< a1dc246f98bb94233effa4fa3ec7bf84700bb7d1
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< 83e1aa9f5f906c9b1f4949d0521f0f950a159d96
`817aa094842dfc3a6b98c9582d4a647827f66201`	affected	< 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[817aa094842dfc3a6b98c9582d4a647827f66201,f76b79d6e42af20682495bccd22f72c7164b0018)`	affected	code_commit	—
`[817aa094842dfc3a6b98c9582d4a647827f66201,a1dc246f98bb94233effa4fa3ec7bf84700bb7d1)`	affected	code_commit	—
`[817aa094842dfc3a6b98c9582d4a647827f66201,83e1aa9f5f906c9b1f4949d0521f0f950a159d96)`	affected	code_commit	—
`[817aa094842dfc3a6b98c9582d4a647827f66201,95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[0,6.13.0)`	unaffected	semver	—
`[0,6.19.0)`	unaffected	semver	—
`[0,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a kernel package that includes the fix commit 83e1aa9f5f906c9b1f4949d0521f0f950a159d96 or newer.
Reboot the system to activate the updated kernel.
If you build your own kernel, apply the patch directly to the source tree, rebuild, and install.

Generated by OpenCVE AI on September 15, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0019.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/11abc34698cb3172badf8aa12e623f1bac98bbd8
https://git.kernel.org/stable/c/37a9d25a563f5f9103282954ce573c4a61321e7c
https://git.kernel.org/stable/c/83e1aa9f5f906c9b1f4949d0521f0f950a159d96
https://git.kernel.org/stable/c/8cc3da72cf57acb4b77442ea8cec48425dff7c06
https://git.kernel.org/stable/c/95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf
https://git.kernel.org/stable/c/a1dc246f98bb94233effa4fa3ec7bf84700bb7d1
https://git.kernel.org/stable/c/ab7405bd86331cc2dbc8201699d4adc33bea75e7
https://git.kernel.org/stable/c/f76b79d6e42af20682495bccd22f72c7164b0018
https://nvd.nist.gov/vuln/detail/CVE-2026-89720
https://www.cve.org/CVERecord?id=CVE-2026-89720

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/11abc34698cb3172badf8aa12e623f1bac98bbd8 https://git.kernel.org/stable/c/37a9d25a563f5f9103282954ce573c4a61321e7c https://git.kernel.org/stable/c/8cc3da72cf57acb4b77442ea8cec48425dff7c06 https://git.kernel.org/stable/c/ab7405bd86331cc2dbc8201699d4adc33bea75e7

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89720 https://www.cve.org/CVERecord?id=CVE-2026-89720
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field before handing the signature payload to verify_pkcs7_signature(), but the check has the wrong sign: if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node)) The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ, 64 bytes) into the node, so the payload is at most snod->len - sizeof(struct ubifs_sig_node) bytes long. Adding the header size instead of subtracting it accepts a declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds -- past the end of c->sbuf, which is vmalloc(c->leb_size). verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder() is then handed that inflated length and reads beyond the allocation while walking the DER headers. The node length comes straight from the mounted image, so a crafted signed UBIFS image reaches this via ubifs_read_superblock() before the signature is cryptographically checked. snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner (c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected subtraction cannot underflow. Legitimately signed images are unaffected: a correct superblock never declares a signature longer than the node it is embedded in.
Title		ubifs: fix out-of-bounds read in signature length check
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/83e1aa9f5f906c9b1f4949d0521f0f950a159d96 https://git.kernel.org/stable/c/95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf https://git.kernel.org/stable/c/a1dc246f98bb94233effa4fa3ec7bf84700bb7d1 https://git.kernel.org/stable/c/f76b79d6e42af20682495bccd22f72c7164b0018

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:32.923Z

Updated: 2026-09-14T12:02:12.826Z

Reserved: 2026-09-11T19:38:34.752Z

Link: CVE-2026-89720

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:00.943

Modified: 2026-09-14T13:19:21.230

Link: CVE-2026-89720

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:32Z

Links: CVE-2026-89720 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:30:12Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object