UnratedFix available
ext4: validate readdir offset before accessing dirent
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len start
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.18.52, 7.2.6
- CVEs
- CVE-2026-92499
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 03:01 UTC · Revision 1
Source evidence
ext4: validate readdir offset before accessing dirent
core-osv · Original sourcePublished 17 Sept 2026, 16:10 UTC
In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len start
osv:CVE-2026-92499
Kernel
Fixed versions: 6.18.52, 7.2.6
Complete source record
{
"id": "d4efc8c38c500f05e82348a4e651a7ccf0e54a6cf0749733f241355b0a2c3067",
"url": "https://osv.dev/vulnerability/CVE-2026-92499",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ext4: validate readdir offset before accessing dirent",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ext4: validate readdir offset before accessing dirent A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len start",
"evidence": "osv:CVE-2026-92499",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.18.52",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-92499",
"aliases": [
"CVE-2026-92499"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ac27a0ec112a089f1a5102bc8dffc79c8c815571"
},
{
"fixed": "64d445d40e5ea4c4d4d88880db753b370cb69161"
},
{
"fixed": "b4c728577933753180e3e97f08424d5bcaff705e"
},
{
"fixed": "bc4b7b0414c33b2c8898eb04386df0d21a13dad8"
}
]
}
],
"versions": [
"v7.2",
"v7.2.5",
"v6.18.51",
"v7.2.4",
"v6.18.50",
"v7.2.3",
"v6.18.49",
"v7.2.2",
"v6.18.48",
"v7.2.1",
"v6.18.47",
"v6.18.46",
"v6.18.45",
"v7.2-rc1",
"v7.2-rc5",
"v6.18.44",
"v7.2-rc7",
"v7.2-rc2",
"v7.2-rc6",
"v7.2-rc3",
"v6.18.43",
"v6.18.42",
"v7.2-rc4",
"v6.18.41",
"v6.18.40",
"v6.18.39",
"v6.18.38",
"v6.18.37",
"v6.18.36",
"v7.1",
"v7.1-rc1",
"v6.18.35",
"v7.1-rc7",
"v7.1-rc6",
"v7.1-rc4",
"v7.1-rc3",
"v6.18.34",
"v7.1-rc2",
"v7.1-rc5",
"v6.18.33",
"v6.18.32",
"v7.0",
"v6.18.31",
"v6.18.30",
"v6.18.29",
"v6.18.28",
"v6.18.27",
"v6.18.26",
"v7.0-rc1",
"v6.18.25",
"v6.18.24",
"v6.18.23",
"v6.18.22",
"v7.0-rc5",
"v7.0-rc6",
"v6.18.21",
"v7.0-rc7",
"v7.0-rc3",
"v7.0-rc4",
"v6.19-rc2",
"v6.18.20",
"v7.0-rc2",
"v6.19",
"v6.18.19",
"v6.18.18",
"v6.18.17",
"v6.18.16",
"v6.18.15",
"v6.18.14",
"v6.18.13",
"v6.18.12",
"v6.18.11",
"v6.18.10",
"v6.18.9",
"v6.19-rc8",
"v6.19-rc1",
"v6.19-rc6",
"v6.18.8",
"v6.19-rc7",
"v6.19-rc5",
"v6.19-rc4",
"v6.18.7",
"v6.19-rc3",
"v6.18.6",
"v6.18.5",
"v6.18.4",
"v6.18.3",
"v6.18.2",
"v6.18.1",
"v6.18",
"v6.18-rc1",
"v6.18-rc7",
"v6.18-rc3",
"v6.18-rc5",
"v6.18-rc6",
"v6.18-rc2",
"v6.18-rc4",
"v6.17",
"v6.17-rc7",
"v6.17-rc1",
"v6.17-rc2",
"v6.17-rc6",
"v6.17-rc4",
"v6.17-rc5",
"v6.17-rc3",
"v6.16",
"v6.16-rc6",
"v6.16-rc1",
"v6.16-rc4",
"v6.16-rc2",
"v6.16-rc5",
"v6.16-rc7",
"v6.16-rc3",
"v6.14-rc3",
"v6.15",
"v6.15-rc1",
"v6.15-rc6",
"v6.15-rc3",
"v6.15-rc2",
"v6.15-rc7",
"v6.15-rc4",
"v6.15-rc5",
"v6.14",
"v6.14-rc1",
"v6.14-rc7",
"v6.14-rc6",
"v6.14-rc4",
"v6.14-rc5",
"v6.14-rc2",
"v6.13",
"v6.13-rc1",
"v6.13-rc6",
"v6.13-rc7",
"v6.13-rc2",
"v6.13-rc5",
"v6.13-rc3",
"v6.12-rc1",
"v6.13-rc4",
"v6.12",
"v6.12-rc7",
"v6.12-rc3",
"v6.12-rc4",
"v6.12-rc6",
"v6.12-rc5",
"v6.12-rc2",
"v6.11-rc1",
"v6.11-rc5",
"v6.11",
"v6.11-rc7",
"v6.10-rc1",
"v6.11-rc6",
"v6.11-rc3",
"v6.11-rc4",
"v6.11-rc2",
"v6.10",
"v6.10-rc6",
"v6.10-rc7",
"v6.10-rc3",
"v6.9-rc1",
"v6.10-rc5",
"v6.10-rc2",
"v6.10-rc4",
"v6.9",
"v6.9-rc6",
"v6.9-rc7",
"v6.9-rc5",
"v6.9-rc3",
"v6.9-rc2",
"v6.8",
"v6.9-rc4",
"v6.8-rc1",
"v6.7-rc1",
"v6.8-rc7",
"v6.8-rc6",
"v6.8-rc5",
"v6.8-rc4",
"v6.8-rc3",
"v6.8-rc2",
"v6.7",
"v6.7-rc3",
"v6.7-rc8",
"v6.7-rc7",
"v6.7-rc6",
"v6.7-rc2",
"v6.7-rc4",
"v6.7-rc5",
"v6.6",
"v6.6-rc1",
"v6.6-rc5",
"v6.6-rc3",
"v6.6-rc7",
"v6.6-rc6",
"v6.6-rc4",
"v6.6-rc2",
"v6.5",
"v6.5-rc1",
"v6.5-rc2",
"v6.5-rc7",
"v6.5-rc4",
"v6.5-rc3",
"v6.5-rc6",
"v6.5-rc5",
"v6.4",
"v6.4-rc7",
"v6.4-rc1",
"v6.4-rc6",
"v6.4-rc5",
"v6.4-rc3",
"v6.4-rc4",
"v6.4-rc2",
"v6.3",
"v6.3-rc1",
"v6.3-rc7",
"v6.3-rc2",
"v6.3-rc3",
"v6.3-rc5",
"v6.3-rc6",
"v6.3-rc4",
"v6.2-rc6",
"v6.2-rc1",
"v6.2",
"v6.2-rc2",
"v6.2-rc8",
"v6.2-rc5",
"v6.2-rc4",
"v6.2-rc7",
"v6.2-rc3",
"v6.1-rc1",
"v6.1",
"v6.1-rc8",
"v6.1-rc3",
"v6.1-rc6",
"v6.1-rc7",
"v6.1-rc4",
"v6.1-rc2",
"v6.1-rc5",
"v6.0-rc1",
"v6.0",
"v6.0-rc7",
"v6.0-rc3",
"v6.0-rc2",
"v6.0-rc6",
"v6.0-rc4",
"v6.0-rc5",
"v5.19",
"v5.19-rc1",
"v5.19-rc5",
"v5.19-rc8",
"v5.19-rc6",
"v5.18",
"v5.19-rc2",
"v5.19-rc7",
"v5.19-rc3",
"v5.19-rc4",
"v5.18-rc1",
"v5.18-rc7",
"v5.18-rc2",
"v5.18-rc5",
"v5.17",
"v5.18-rc4",
"v5.18-rc3",
"v5.18-rc6",
"v5.17-rc6",
"v5.17-rc4",
"v5.17-rc8",
"v5.17-rc7",
"v5.17-rc1",
"v5.17-rc3",
"v5.17-rc2",
"v5.17-rc5",
"v5.16",
"v5.16-rc1",
"v5.16-rc8",
"v5.16-rc5",
"v5.16-rc6",
"v5.16-rc7",
"v5.16-rc3",
"v5.16-rc2",
"v5.16-rc4",
"v5.15",
"v5.15-rc2",
"v5.15-rc1",
"v5.15-rc4",
"v5.15-rc7",
"v5.15-rc3",
"v5.15-rc5",
"v5.15-rc6",
"v5.14",
"v5.14-rc3",
"v5.14-rc1",
"v5.14-rc2",
"v5.14-rc7",
"v5.14-rc6",
"v5.13-rc1",
"v5.14-rc5",
"v5.14-rc4",
"v5.13",
"v5.13-rc6",
"v5.13-rc7",
"v5.13-rc3",
"v5.13-rc2",
"v5.13-rc4",
"v5.13-rc5",
"v5.12",
"v5.12-rc2",
"v5.12-rc1-dontuse",
"v5.12-rc1",
"v5.12-rc8",
"v5.12-rc3",
"v5.12-rc7",
"v5.12-rc5",
"v5.12-rc6",
"v5.12-rc4",
"v5.10",
"v5.11",
"v5.11-rc3",
"v5.11-rc7",
"v5.11-rc6",
"v5.11-rc5",
"v5.11-rc1",
"v5.11-rc4",
"v5.11-rc2",
"v5.10-rc1",
"v5.10-rc7",
"v5.10-rc4",
"v5.10-rc3",
"v5.10-rc6",
"v5.9",
"v5.10-rc2",
"v5.10-rc5",
"v5.9-rc1",
"v5.9-rc7",
"v5.9-rc8",
"v5.9-rc6",
"v5.9-rc4",
"v5.9-rc5",
"v5.9-rc3",
"v5.9-rc2",
"v5.8",
"v5.7",
"v5.8-rc2",
"v5.8-rc1",
"v5.8-rc7",
"v5.8-rc5",
"v5.8-rc3",
"v5.8-rc4",
"v5.8-rc6",
"v5.7-rc4",
"v5.7-rc7",
"v5.7-rc1",
"v5.7-rc3",
"v5.7-rc2",
"v5.7-rc5",
"v5.7-rc6",
"v5.6",
"v5.6-rc1",
"v5.6-rc7",
"v5.6-rc6",
"v5.6-rc3",
"v5.6-rc4",
"v5.6-rc2",
"v5.6-rc5",
"v5.5",
"v5.5-rc5",
"v5.5-rc7",
"v5.5-rc2",
"v5.5-rc1",
"v5.4",
"v5.5-rc4",
"v5.5-rc3",
"v5.5-rc6",
"v5.4-rc1",
"v5.4-rc6",
"v5.4-rc3",
"v5.4-rc4",
"v5.4-rc8",
"v5.4-rc7",
"v5.4-rc5",
"v5.3",
"v5.4-rc2",
"v5.3-rc5",
"v5.3-rc1",
"v5.3-rc2",
"v5.3-rc3",
"v5.3-rc8",
"v5.3-rc7",
"v5.3-rc4",
"v5.2",
"v5.3-rc6",
"v5.2-rc2",
"v5.2-rc7",
"v5.2-rc4",
"v5.2-rc1",
"v5.2-rc5",
"v5.2-rc6",
"v5.2-rc3",
"v5.1",
"v5.0-rc8",
"v5.1-rc7",
"v5.1-rc1",
"v5.1-rc6",
"v5.1-rc5",
"v5.0",
"v5.1-rc3",
"v5.1-rc2",
"v5.1-rc4",
"v5.0-rc1",
"v5.0-rc4",
"v5.0-rc3",
"v5.0-rc6",
"v5.0-rc7",
"v5.0-rc2",
"v5.0-rc5",
"v4.20-rc1",
"v4.19",
"v4.20",
"v4.20-rc7",
"v4.20-rc5",
"v4.20-rc6",
"v4.20-rc4",
"v4.20-rc2",
"v4.20-rc3",
"v4.19-rc2",
"v4.19-rc8",
"v4.19-rc4",
"v4.19-rc1",
"v4.19-rc7",
"v4.19-rc6",
"v4.19-rc5",
"v4.19-rc3",
"v4.18",
"v4.18-rc1",
"v4.18-rc8",
"v4.18-rc2",
"v4.18-rc5",
"v4.18-rc6",
"v4.18-rc7",
"v4.17",
"v4.18-rc3",
"v4.18-rc4",
"v4.17-rc1",
"v4.17-rc2",
"v4.17-rc7",
"v4.17-rc3",
"v4.17-rc4",
"v4.16",
"v4.17-rc6",
"v4.17-rc5",
"v4.16-rc7",
"v4.16-rc4",
"v4.16-rc1",
"v4.16-rc2",
"v4.16-rc5",
"v4.16-rc3",
"v4.16-rc6",
"v4.14",
"v4.15",
"v4.15-rc1",
"v4.15-rc4",
"v4.15-rc9",
"v4.15-rc8",
"v4.15-rc7",
"v4.15-rc3",
"v4.15-rc2",
"v4.15-rc5",
"v4.15-rc6",
"v4.14-rc1",
"v4.14-rc7",
"v4.14-rc3",
"v4.13",
"v4.14-rc8",
"v4.14-rc4",
"v4.14-rc6",
"v4.14-rc2",
"v4.14-rc5",
"v4.13-rc2",
"v4.13-rc1",
"v4.13-rc3",
"v4.13-rc7",
"v4.13-rc4",
"v4.13-rc5",
"v4.13-rc6",
"v4.12-rc1",
"v4.12",
"v4.12-rc5",
"v4.12-rc7",
"v4.12-rc6",
"v4.12-rc4",
"v4.12-rc2",
"v4.12-rc3",
"v4.11",
"v4.11-rc1",
"v4.11-rc6",
"v4.11-rc8",
"v4.11-rc7",
"v4.11-rc3",
"v4.11-rc5",
"v4.11-rc2",
"v4.11-rc4",
"v4.10",
"v4.9",
"v4.10-rc8",
"v4.10-rc3",
"v4.10-rc1",
"v4.10-rc7",
"v4.10-rc6",
"v4.10-rc2",
"v4.10-rc5",
"v4.10-rc4",
"v4.9-rc7",
"v4.9-rc6",
"v4.9-rc8",
"v4.9-rc1",
"v4.9-rc5",
"v4.9-rc3",
"v4.9-rc4",
"v4.9-rc2",
"v4.8",
"v4.8-rc8",
"v4.8-rc2",
"v4.8-rc1",
"v4.8-rc7",
"v4.8-rc6",
"v4.8-rc5",
"v4.8-rc4",
"v4.8-rc3",
"v4.7",
"v4.7-rc4",
"v4.7-rc2",
"v4.7-rc1",
"v4.7-rc7",
"v4.7-rc6",
"v4.7-rc3",
"v4.7-rc5",
"v4.6",
"v4.6-rc1",
"v4.6-rc6",
"v4.6-rc4",
"v4.6-rc7",
"v4.6-rc5",
"v4.5-rc4",
"v4.6-rc2",
"v4.6-rc3",
"v4.5",
"v4.4",
"v4.5-rc1",
"v4.5-rc6",
"v4.5-rc2",
"v4.5-rc7",
"v4.5-rc5",
"v4.5-rc3",
"v4.4-rc1",
"v4.4-rc2",
"v4.4-rc8",
"v4.4-rc3",
"v4.4-rc7",
"v4.4-rc5",
"v4.4-rc6",
"v4.4-rc4",
"v4.3",
"v4.3-rc1",
"v4.3-rc6",
"v4.3-rc4",
"v4.3-rc2",
"v4.3-rc7",
"v4.3-rc5",
"v4.3-rc3",
"v4.2",
"v4.2-rc2",
"v4.2-rc1",
"v4.2-rc8",
"v4.2-rc4",
"v4.2-rc6",
"v4.2-rc7",
"v4.0-rc5",
"v4.2-rc5",
"v4.2-rc3",
"v4.1-rc2",
"v4.1",
"v4.1-rc1",
"v4.1-rc8",
"v4.1-rc7",
"v4.1-rc6",
"v4.1-rc3",
"v4.1-rc4",
"v4.0",
"v4.1-rc5",
"v4.0-rc1",
"v4.0-rc2",
"v4.0-rc7",
"v4.0-rc3",
"v4.0-rc6",
"v4.0-rc4",
"v3.19",
"v3.19-rc7",
"v3.19-rc5",
"v3.19-rc1",
"v3.19-rc6",
"v3.19-rc4",
"v3.18-rc1",
"v3.19-rc3",
"v3.19-rc2",
"v3.18",
"v3.18-rc7",
"v3.18-rc6",
"v3.18-rc2",
"v3.18-rc3",
"v3.18-rc4",
"v3.18-rc5",
"v3.17",
"v3.17-rc1",
"v3.17-rc7",
"v3.17-rc2",
"v3.17-rc4",
"v3.16",
"v3.17-rc5",
"v3.17-rc6",
"v3.17-rc3",
"v3.16-rc7",
"v3.16-rc1",
"v3.16-rc3",
"v3.16-rc5",
"v3.16-rc6",
"v3.16-rc2",
"v3.16-rc4",
"v3.13",
"v3.15",
"v3.15-rc5",
"v3.15-rc8",
"v3.15-rc1",
"v3.15-rc6",
"v3.15-rc3",
"v3.15-rc7",
"v3.15-rc2",
"v3.15-rc4",
"v3.14",
"v3.14-rc4",
"v3.14-rc8",
"v3.14-rc7",
"v3.14-rc6",
"v3.14-rc1",
"v3.14-rc2",
"v3.14-rc5",
"v3.14-rc3",
"v3.13-rc6",
"v3.13-rc8",
"v3.12",
"v3.13-rc7",
"v3.13-rc1",
"v3.13-rc4",
"v3.13-rc3",
"v3.13-rc5",
"v3.13-rc2",
"v3.12-rc7",
"v3.12-rc3",
"v3.12-rc6",
"v3.12-rc1",
"v3.12-rc5",
"v3.11",
"v3.12-rc2",
"v3.12-rc4",
"v3.11-rc7",
"v3.11-rc2",
"v3.11-rc5",
"v3.11-rc1",
"v3.11-rc3",
"v3.11-rc4",
"v3.11-rc6",
"v3.10-rc2",
"v3.10",
"v3.10-rc7",
"v3.10-rc6",
"v3.10-rc1",
"v3.10-rc5",
"v3.10-rc3",
"v3.10-rc4",
"v3.9",
"v3.9-rc2",
"v3.9-rc7",
"v3.9-rc8",
"v3.9-rc3",
"v3.9-rc6",
"v3.9-rc5",
"v3.9-rc4",
"v3.9-rc1",
"v3.8",
"v3.8-rc7",
"v3.8-rc6",
"v3.8-rc5",
"v3.8-rc2",
"v3.8-rc1",
"v3.8-rc3",
"v3.8-rc4",
"v3.7",
"v3.7-rc1",
"v3.6",
"v3.7-rc6",
"v3.7-rc7",
"v3.7-rc3",
"v3.7-rc8",
"v3.7-rc2",
"v3.7-rc4",
"v3.7-rc5",
"v3.6-rc7",
"v3.6-rc1",
"v3.5-rc3",
"v3.6-rc6",
"v3.6-rc5",
"v3.5",
"v3.6-rc3",
"v3.6-rc4",
"v3.6-rc2",
"v3.4-rc4",
"v3.5-rc7",
"v3.5-rc5",
"v3.5-rc6",
"v3.5-rc2",
"v3.5-rc1",
"v3.5-rc4",
"v3.4",
"v3.4-rc2",
"v3.4-rc1",
"v3.4-rc7",
"v3.4-rc6",
"v3.4-rc3",
"v3.4-rc5",
"v3.3",
"v3.3-rc6",
"v3.3-rc3",
"v3.3-rc7",
"v3.3-rc2",
"v3.3-rc5",
"v3.2",
"v3.3-rc4",
"v3.3-rc1",
"v3.2-rc4",
"v3.2-rc7",
"v3.2-rc6",
"v3.2-rc5",
"v3.2-rc3",
"v3.1",
"v3.2-rc2",
"v3.2-rc1",
"v3.1-rc1",
"v3.1-rc9",
"v3.1-rc8",
"v3.1-rc10",
"v3.1-rc7",
"v3.1-rc3",
"v3.1-rc2",
"v3.1-rc4",
"v3.1-rc5",
"v3.0",
"v3.1-rc6",
"v3.0-rc7",
"v3.0-rc4",
"v3.0-rc6",
"v3.0-rc5",
"v3.0-rc3",
"v3.0-rc1",
"v2.6.39",
"v3.0-rc2",
"v2.6.38",
"v2.6.39-rc2",
"v2.6.39-rc7",
"v2.6.39-rc5",
"v2.6.39-rc1",
"v2.6.38-rc7",
"v2.6.39-rc6",
"v2.6.39-rc4",
"v2.6.39-rc3",
"v2.6.37",
"v2.6.38-rc1",
"v2.6.38-rc8",
"v2.6.38-rc2",
"v2.6.38-rc6",
"v2.6.38-rc5",
"v2.6.38-rc4",
"v2.6.38-rc3",
"v2.6.37-rc4",
"v2.6.37-rc2",
"v2.6.36",
"v2.6.37-rc5",
"v2.6.37-rc8",
"v2.6.37-rc7",
"v2.6.37-rc6",
"v2.6.37-rc1",
"v2.6.37-rc3",
"v2.6.36-rc6",
"v2.6.35-rc4",
"v2.6.36-rc8",
"v2.6.35",
"v2.6.36-rc7",
"v2.6.36-rc3",
"v2.6.36-rc5",
"v2.6.36-rc4",
"v2.6.36-rc2",
"v2.6.36-rc1",
"v2.6.35-rc5",
"v2.6.35-rc6",
"v2.6.34",
"v2.6.35-rc3",
"v2.6.35-rc1",
"v2.6.35-rc2",
"v2.6.34-rc7",
"v2.6.34-rc6",
"v2.6.34-rc5",
"v2.6.34-rc4",
"v2.6.34-rc3",
"v2.6.34-rc2",
"v2.6.34-rc1",
"v2.6.33",
"v2.6.33-rc6",
"v2.6.33-rc8",
"v2.6.33-rc4",
"v2.6.33-rc5",
"v2.6.33-rc3",
"v2.6.33-rc7",
"v2.6.33-rc2",
"v2.6.32",
"v2.6.33-rc1",
"v2.6.32-rc8",
"v2.6.32-rc7",
"v2.6.32-rc6",
"v2.6.31",
"v2.6.32-rc5",
"v2.6.32-rc4",
"v2.6.32-rc2",
"v2.6.32-rc1",
"v2.6.32-rc3",
"v2.6.31-rc9",
"v2.6.31-rc1",
"v2.6.31-rc7",
"v2.6.31-rc8",
"v2.6.31-rc6",
"v2.6.30-rc6",
"v2.6.30",
"v2.6.31-rc4",
"v2.6.31-rc5",
"v2.6.31-rc3",
"v2.6.31-rc2",
"v2.6.30-rc7",
"v2.6.30-rc8",
"v2.6.30-rc5",
"v2.6.30-rc3",
"v2.6.30-rc4",
"v2.6.30-rc1",
"v2.6.30-rc2",
"v2.6.29",
"v2.6.29-rc8",
"v2.6.29-rc7",
"v2.6.29-rc5",
"v2.6.29-rc1",
"v2.6.29-rc6",
"v2.6.29-rc4",
"v2.6.29-rc3",
"v2.6.29-rc2",
"v2.6.28",
"v2.6.28-rc7",
"v2.6.28-rc9",
"v2.6.28-rc8",
"v2.6.28-rc6",
"v2.6.28-rc5",
"v2.6.28-rc4",
"v2.6.28-rc2",
"v2.6.28-rc3",
"v2.6.28-rc1",
"v2.6.27",
"v2.6.27-rc7",
"v2.6.27-rc9",
"v2.6.27-rc8",
"v2.6.27-rc5",
"v2.6.27-rc6",
"v2.6.27-rc4",
"v2.6.27-rc1",
"v2.6.27-rc3",
"v2.6.27-rc2",
"v2.6.26",
"v2.6.26-rc9",
"v2.6.26-rc8",
"v2.6.26-rc3",
"v2.6.26-rc7",
"v2.6.26-rc6",
"v2.6.26-rc5",
"v2.6.26-rc4",
"v2.6.26-rc2",
"v2.6.26-rc1",
"v2.6.25",
"v2.6.25-rc7",
"v2.6.25-rc9",
"v2.6.25-rc8",
"v2.6.25-rc6",
"v2.6.25-rc5",
"v2.6.25-rc3",
"v2.6.25-rc4",
"v2.6.24",
"v2.6.25-rc2",
"v2.6.25-rc1",
"v2.6.24-rc8",
"v2.6.24-rc7",
"v2.6.24-rc6",
"v2.6.24-rc5",
"v2.6.24-rc4",
"v2.6.24-rc3",
"v2.6.24-rc2",
"v2.6.24-rc1",
"v2.6.23",
"v2.6.23-rc9",
"v2.6.23-rc8",
"v2.6.23-rc5",
"v2.6.23-rc7",
"v2.6.23-rc6",
"v2.6.23-rc4",
"v2.6.23-rc3",
"v2.6.23-rc2",
"v2.6.23-rc1",
"v2.6.22",
"v2.6.22-rc7",
"v2.6.22-rc6",
"v2.6.22-rc5",
"v2.6.22-rc4",
"v2.6.22-rc3",
"v2.6.22-rc2",
"v2.6.22-rc1",
"v2.6.21",
"v2.6.21-rc7",
"v2.6.21-rc6",
"v2.6.21-rc5",
"v2.6.21-rc4",
"v2.6.21-rc3",
"v2.6.21-rc2",
"v2.6.21-rc1",
"v2.6.20-rc7",
"v2.6.20-rc6",
"v2.6.20-rc5",
"v2.6.20-rc4",
"v2.6.20-rc3",
"v2.6.20-rc1",
"v2.6.20-rc2",
"v2.6.19-rc2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92499.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.19"
},
{
"fixed": "6.18.52"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92499.json"
}
}
],
"modified": "2026-10-28T02:30:49.071421424Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161",
"https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e",
"https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92499.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-92499",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92499.json"
}
},
"related_cves": [
{
"value": "CVE-2026-92499",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 517587,
"published_at": "2026-09-17T16:10:13.391+00:00"
}