{"api_version":"1","generated_at":"2026-09-12T11:10:18+00:00","cve":"CVE-2026-89720","urls":{"html":"https://cve.report/CVE-2026-89720","api":"https://cve.report/api/cve/CVE-2026-89720.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89720","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89720"},"summary":{"title":"ubifs: fix out-of-bounds read in signature length check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: fix out-of-bounds read in signature length check\n\nubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field\nbefore handing the signature payload to verify_pkcs7_signature(), but the\ncheck has the wrong sign:\n\n\tif (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))\n\nThe signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,\n64 bytes) into the node, so the payload is at most\n\n\tsnod->len - sizeof(struct ubifs_sig_node)\n\nbytes long. Adding the header size instead of subtracting it accepts a\ndeclared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually\nholds -- past the end of c->sbuf, which is vmalloc(c->leb_size).\nverify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()\nis then handed that inflated length and reads beyond the allocation while\nwalking the DER headers. The node length comes straight from the mounted\nimage, so a crafted signed UBIFS image reaches this via\nubifs_read_superblock() before the signature is cryptographically checked.\n\nsnod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner\n(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected\nsubtraction cannot underflow. Legitimately signed images are unaffected: a\ncorrect superblock never declares a signature longer than the node it is\nembedded in.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:20:00","updated_at":"2026-09-11 20:20:00"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/83e1aa9f5f906c9b1f4949d0521f0f950a159d96","name":"https://git.kernel.org/stable/c/83e1aa9f5f906c9b1f4949d0521f0f950a159d96","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a1dc246f98bb94233effa4fa3ec7bf84700bb7d1","name":"https://git.kernel.org/stable/c/a1dc246f98bb94233effa4fa3ec7bf84700bb7d1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f76b79d6e42af20682495bccd22f72c7164b0018","name":"https://git.kernel.org/stable/c/f76b79d6e42af20682495bccd22f72c7164b0018","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf","name":"https://git.kernel.org/stable/c/95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89720","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89720","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 817aa094842dfc3a6b98c9582d4a647827f66201 f76b79d6e42af20682495bccd22f72c7164b0018 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 817aa094842dfc3a6b98c9582d4a647827f66201 a1dc246f98bb94233effa4fa3ec7bf84700bb7d1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 817aa094842dfc3a6b98c9582d4a647827f66201 83e1aa9f5f906c9b1f4949d0521f0f950a159d96 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 817aa094842dfc3a6b98c9582d4a647827f66201 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ubifs/auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f76b79d6e42af20682495bccd22f72c7164b0018","status":"affected","version":"817aa094842dfc3a6b98c9582d4a647827f66201","versionType":"git"},{"lessThan":"a1dc246f98bb94233effa4fa3ec7bf84700bb7d1","status":"affected","version":"817aa094842dfc3a6b98c9582d4a647827f66201","versionType":"git"},{"lessThan":"83e1aa9f5f906c9b1f4949d0521f0f950a159d96","status":"affected","version":"817aa094842dfc3a6b98c9582d4a647827f66201","versionType":"git"},{"lessThan":"95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf","status":"affected","version":"817aa094842dfc3a6b98c9582d4a647827f66201","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ubifs/auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: fix out-of-bounds read in signature length check\n\nubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field\nbefore handing the signature payload to verify_pkcs7_signature(), but the\ncheck has the wrong sign:\n\n\tif (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))\n\nThe signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,\n64 bytes) into the node, so the payload is at most\n\n\tsnod->len - sizeof(struct ubifs_sig_node)\n\nbytes long. Adding the header size instead of subtracting it accepts a\ndeclared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually\nholds -- past the end of c->sbuf, which is vmalloc(c->leb_size).\nverify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()\nis then handed that inflated length and reads beyond the allocation while\nwalking the DER headers. The node length comes straight from the mounted\nimage, so a crafted signed UBIFS image reaches this via\nubifs_read_superblock() before the signature is cryptographically checked.\n\nsnod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner\n(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected\nsubtraction cannot underflow. Legitimately signed images are unaffected: a\ncorrect superblock never declares a signature longer than the node it is\nembedded in."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:46:32.923Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f76b79d6e42af20682495bccd22f72c7164b0018"},{"url":"https://git.kernel.org/stable/c/a1dc246f98bb94233effa4fa3ec7bf84700bb7d1"},{"url":"https://git.kernel.org/stable/c/83e1aa9f5f906c9b1f4949d0521f0f950a159d96"},{"url":"https://git.kernel.org/stable/c/95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf"}],"title":"ubifs: fix out-of-bounds read in signature length check","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89720","datePublished":"2026-09-11T19:46:32.923Z","dateReserved":"2026-09-11T19:38:34.752Z","dateUpdated":"2026-09-11T19:46:32.923Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:20:00","lastModifiedDate":"2026-09-11 20:20:00","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89720","Ordinal":"1","Title":"ubifs: fix out-of-bounds read in signature length check","CVE":"CVE-2026-89720","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89720","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: fix out-of-bounds read in signature length check\n\nubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field\nbefore handing the signature payload to verify_pkcs7_signature(), but the\ncheck has the wrong sign:\n\n\tif (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))\n\nThe signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,\n64 bytes) into the node, so the payload is at most\n\n\tsnod->len - sizeof(struct ubifs_sig_node)\n\nbytes long. Adding the header size instead of subtracting it accepts a\ndeclared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually\nholds -- past the end of c->sbuf, which is vmalloc(c->leb_size).\nverify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()\nis then handed that inflated length and reads beyond the allocation while\nwalking the DER headers. The node length comes straight from the mounted\nimage, so a crafted signed UBIFS image reaches this via\nubifs_read_superblock() before the signature is cryptographically checked.\n\nsnod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner\n(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected\nsubtraction cannot underflow. Legitimately signed images are unaffected: a\ncorrect superblock never declares a signature longer than the node it is\nembedded in.","Type":"Description","Title":"ubifs: fix out-of-bounds read in signature length check"}]}}}