01 Record

CVE-2026-31449

ext4: validate p_idx bounds in ext4_ext_correct_indexes

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ext4: validate p_idx bounds in ext4_ext_correct_indexes

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.14% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 3.4% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-04-22 13:53Z4 MO AGO

Last updated

2026-08-05 12:22Z1 MO AGO

Reserved

2026-03-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase
CWE-1285Improper Validation of Specified Index, Position, or Offset in InputBase

Data version

5.2

Document digest

9ebd80dd20f18f0cc914c59e60f1257b499212cee94d4eb2cd86d60b10d68819

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxa86c61812637c7dd0c57e29880cffd477b62f2e7 to < 39d6e2b67651614bac0dc6592fa9836321910067, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < c5839b34704c9c2f47f079451bdbb22de0da1ed1, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < 10242e640b36b91ad03d25f3dc77854bbdff8358, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < 4d08401aa13f1531216f1a7ae281ca4806e90a5c, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < 407c944f217c17d4343148011acafebc604d55e1, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < 93f2e975ed658ce09db4d4c2877ca2c06540df83, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < 01bf1e0b997d82c0e353b51ed74ef99698043c33, a86c61812637c7dd0c57e29880cffd477b62f2e7 to < 2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8, 2.6.19—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067
git.kernel.orghttps://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1
git.kernel.orghttps://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358
git.kernel.orghttps://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c
git.kernel.orghttps://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1
git.kernel.orghttps://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83
git.kernel.orghttps://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33
git.kernel.orghttps://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8

01 Record index

CVE-2026-31449

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2026-31449

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References