Security readout for executives and security teams
Plain-English summary
A malformed or corrupted ext4 filesystem can make the Linux kernel read beyond an allocated memory buffer while updating filesystem indexes. Exploitation requires local interaction with affected filesystem data, so this is not described as a directly remote flaw. Successful triggering could expose sensitive memory, corrupt system behavior, or crash a host.
Executive priority
Prioritize patching systems that ingest untrusted storage, virtual-disk images, backups, or removable media. Treat ordinary servers with only trusted local ext4 storage as lower immediate exposure, while still updating through normal kernel maintenance. Escalate rapidly if monitoring identifies ext4 corruption or kernel memory-safety reports.
Technical view
ext4_ext_correct_indexes() trusted an extent-header entry count when deriving p_idx. Crafted or corrupted eh_entries metadata could place p_idx beyond EXT_LAST_INDEX(), causing a slab out-of-bounds read at two ei_block access sites. The stable fixes validate both accesses and return -EFSCORRUPTED when the pointer exceeds valid index bounds.
Likely exposure
Exposure is most plausible on affected Linux systems that mount or process untrusted, removable, imported, or attacker-influenced ext4 filesystems or images. The supplied version data is ambiguously structured, so administrators should map their distribution kernel package to vendor advisories or the referenced stable commits rather than relying solely on version numbers.
Exploitation context
The supplied CVSS vector is local, low-complexity, requires no privileges, and requires user interaction. The bundle does not report CISA KEV inclusion or provide evidence of active exploitation. A crafted or corrupted ext4 extent tree is required; direct network exploitation is not established by the supplied sources.
Researcher notes
No CWE is supplied. The documented primitive is a slab out-of-bounds read caused by insufficient p_idx validation. Although CVSS claims high confidentiality, integrity, and availability impacts, the bundle does not establish a demonstrated exploit outcome. Exact affected and fixed package boundaries require distribution-specific confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check distribution guidance to map packaged kernels and backports to the fix.
- Restrict mounting or processing of untrusted ext4 media and filesystem images until updated.
- Apply least privilege to workflows handling removable, imported, or externally supplied storage.
Validation and detection
- Inventory Linux kernel packages on systems that handle ext4 filesystems or images.
- Confirm the installed kernel includes the applicable stable fix or vendor backport.
- Review storage workflows for attacker-influenced ext4 media, images, snapshots, or virtual disks.
- Check kernel and filesystem logs for ext4 corruption or slab out-of-bounds reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31449 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067CVE reference, Linux
- https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1CVE reference, Linux
- https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358CVE reference, Linux
- https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5cCVE reference, Linux
- https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1CVE reference, Linux
- https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83CVE reference, Linux
- https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33CVE reference, Linux
- https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.