---
id: CVE-2026-89720
title: 'ubifs: fix out-of-bounds read in signature length check'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ubifs: fix out-of-bounds read in signature length check

  ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
  before handing the signature payload t…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    ab7405bd86331cc2dbc8201699d4adc33bea75e7
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    11abc34698cb3172badf8aa12e623f1bac98bbd8
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    8cc3da72cf57acb4b77442ea8cec48425dff7c06
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    37a9d25a563f5f9103282954ce573c4a61321e7c
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    f76b79d6e42af20682495bccd22f72c7164b0018
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    a1dc246f98bb94233effa4fa3ec7bf84700bb7d1
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    83e1aa9f5f906c9b1f4949d0521f0f950a159d96
  - >-
    Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 <
    95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf
  - Linux 5.3
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:33.033Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89720'
references:
  - url: 'https://git.kernel.org/stable/c/ab7405bd86331cc2dbc8201699d4adc33bea75e7'
  - url: 'https://git.kernel.org/stable/c/11abc34698cb3172badf8aa12e623f1bac98bbd8'
  - url: 'https://git.kernel.org/stable/c/8cc3da72cf57acb4b77442ea8cec48425dff7c06'
  - url: 'https://git.kernel.org/stable/c/37a9d25a563f5f9103282954ce573c4a61321e7c'
  - url: 'https://git.kernel.org/stable/c/f76b79d6e42af20682495bccd22f72c7164b0018'
  - url: 'https://git.kernel.org/stable/c/a1dc246f98bb94233effa4fa3ec7bf84700bb7d1'
  - url: 'https://git.kernel.org/stable/c/83e1aa9f5f906c9b1f4949d0521f0f950a159d96'
  - url: 'https://git.kernel.org/stable/c/95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89720.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89720'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532147'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89720'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89720'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89720.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00185
epssPercentile: 0.08014
scores:
  cna: 7.7
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ubifs: fix out-of-bounds read in signature length check

ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
before handing the signature payload to verify_pkcs7_signature(), but the
check has the wrong sign:

	if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))

The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
64 bytes) into the node, so the payload is at most

	snod->len - sizeof(struct ubifs_sig_node)

bytes long. Adding the header size instead of subtracting it accepts a
declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually
holds -- past the end of c->sbuf, which is vmalloc(c->leb_size).
verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()
is then handed that inflated length and reads beyond the allocation while
walking the DER headers. The node length comes straight from the mounted
image, so a crafted signed UBIFS image reaches this via
ubifs_read_superblock() before the signature is cryptographically checked.

snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner
(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected
subtraction cannot underflow. Legitimately signed images are unaffected: a
correct superblock never declares a signature longer than the node it is
embedded in.

## Affected

- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < ab7405bd86331cc2dbc8201699d4adc33bea75e7`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < 11abc34698cb3172badf8aa12e623f1bac98bbd8`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < 8cc3da72cf57acb4b77442ea8cec48425dff7c06`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < 37a9d25a563f5f9103282954ce573c4a61321e7c`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < f76b79d6e42af20682495bccd22f72c7164b0018`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < a1dc246f98bb94233effa4fa3ec7bf84700bb7d1`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < 83e1aa9f5f906c9b1f4949d0521f0f950a159d96`
- `Linux >= 817aa094842dfc3a6b98c9582d4a647827f66201 < 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89720.json)